[l23k4]

Already done, it's called a "browser-in-browser" attack.