It doesn't compromise the master-password and is not wide-reaching as it requires the victim to be lured to a specific website.

Doesn't match what people claim here