This depends on the capabilities of the attacker and the target website. If the target website was never visited by the victim with the current browser or if the target site did not employ HSTS then attacks using sslstrip are still possible.
Beyond that stealth MITM-attacks are still possible if the victim has a CA installed as trusted on its system where the private key is known to the attacker. This could be certificates installed by the vendor, like in the case of the SuperFisch software installed by Lenovo or the CA certificate installed by Dell. Usually such known compromised CA certificates are blocked but the recent disaster with a software for secure communication between lawyers shows that even large vendors are still unaware of these problems and thus will install new CA certificates on the system with a badly secured private key. And such CA certificate could also be installed by (often ad-injecting) malware, like in case of the recent OSX/MaMi malware.
Apart from that there are attacks possible using browser extensions which simply bypass breaking HTTPS since they have access to the plain traffic. In the past multiple innocent browser extensions changed their behavior and went rouge, like described in When Browser Extensions Go Rogue.
And then of course the attacker might use vulnerabilities of the system or use social tricks to make the user install some malware, which might install a new browser extension, hijack the browser or just replace it. This way the attacker too gets access to the plain traffic.