I've never before seen anything like this. Is this the only case or
has this been known to happen?
The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario.
There is one interesting scenario about your question: as @RоryMcCune said, what you witnessed is quite frequent, so an attacker could impersonate that pop-up. I mean, an attacker who succeed to compromise a given website can craft a pop-up similar to that one since it is widespread and trusted.
This impersonation can be used to perform two purposes:
- Clickjacking attacks
- Drive-by download attacks
The worst aspect of this negative scenario is that drive-by download attacks consist in downloading without your consent a malware (even if spywares and malwares are more used with this method) on your machine/phone. There are two ways this could be triggered: without any interaction, I mean by just visiting a a website, or by requiring the user's interaction via, for instance, clicking to confirm, cancel or exit a pop-up message (as in your case). These attacks exploit vulnerabilities of browsers you use or their plugins.
Did drive-by download attacks happen on some famous websites as you asked? Yes. Let me mention one good example: on 2011, an attack exploited the Java browser plugin to infect thousands of victims who visited Amnesty International's homepage in UK.
Your scenario could also be a clickjacking attack in which the victim is tricked to click on some online content that is intended either for advertisement or, in worst case, to steal sensible/private information from you or even compromise your machine using the drive-by download attack as a complement method. Such attacks target social networks such as Facebook, Twitter (and this is frequent).