It didn't work! Score another point for NoScript. :-)
I tried Chrome and still use it for certain things, but I refuse to use it as my primary browser until it has NoScript or equivalent.
I tried Chrome and still use it for certain things, but I refuse to use it as my primary browser until it has NoScript or equivalent.
You might be able perform the same attack using hanging HTTP requests to load a stylesheet and favicon at the bottom of the page. Defer completion of the requests for several minutes until it's likely the user has moved on to another tab. Stylesheet displays the hidden phishing UI, favicon is loaded. Bam, same effect.
Alternatively use a meta refresh tag to simply redirect to an entirely different page.
That was going to be my suggestion too. In fact that would be my preferred attack because you could change the URL to something that looked "kosher" as well.
[edit]
The "no javascript" control is under "Options / Under the Hood" click the "Content Settings" button. I see the ability to disable javascript and add exceptions. Javascript can be enabled by clicking on the icon at the right-hand side of the address bar. Cool!
Clever idea. Has the demo worked for anyone? (Edit: I see below that posters report that this worked for at least some versions of Chrome on Windows)