When a user enters his credentials in the login form of a web application, the credentials can be hacked through a malicious extension (that the user has installed). Now, suppose the malicious extension wants to pass the hacked credentials to the attacker's server, it is prevented through the Same-origin policy of the web. However, another way of passing the credentials to the attacker's server is through a pop up window where the captured details can be parsed in the URL and passed to the attacker's server. The window can be closed immediately. Even though the possibility of such an attack is very minimal and can be easily seen by the user, it cannot be denied that it is not impossible. On an average, it just takes 1.5 seconds to open and close a pop up where the credentials can be passed to the attacker. And if suppose the pop up window is very small and is configured to launch at a side of the screen, the user will be having no idea about this attack at all.