Can a certificate be spoofed at the browser level? Meaning I go click the LOCK image in my url bar and it shows a valid certificate from VeriSign but somehow the attacker spoofed that information. I'm not sure how they could do it and that's what I'm asking specifically. Could they use ECMAScript? Could they write a browser extension or plugin in C that could somehow update that info?
Well, if you modify the browser, you've basically modified the operating system of the user. In that case, you could also directly install a keylogger or password grabber.
The function of that lock symbol in non-modified browsers of course is to demonstrate the cryptographic security of a site, so obviously, it's not possible to interact with it from a website other than supplying a valid certificate that matches a CA the browser trusts. That is, of course, bugs and backdoors aside, but frankly, I don't think you'll find a blatant security hole in modern browsers that'd allow you to fake that symbol.
Technically -- yes, they could. However, there are few thoughts:
1) web page code cannot interact with browser's address bar.
2) an attacker may write a plugin/extension if web browser provides interfaces for such interactions.
2.1) an attacker can spoof browser's binary modules to change browser behavior. However, this will require source code knowledge and an ability to overwrite binaries.
In reality it is very and very unlikely. This attack vector assumes that attacker already gained access to your computer. In this case, he don't need to do such complex manipulations, it is easier to insert rogue root certificate in trust store and use it to spoof users.