Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token.
A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the page with the password and sends this password via html5 windows.postMessage() to another iframe (sourcing the attacker's site) which takes this password and sends it off to the hacker's site via a query parameter in an http get to a hacker's web service.
Via phishing attack, the hacker entices user with open session to click on the link for his webpage having these 2 iframes and steals the password.
Is this attack possible?