Attacker iframe

Frame origin:

Tap the password field, then use Chrome manual password fill.