[awj]

That's a ridiculous argument. If the attacker could do that why would they even bother with XSS attacks based on developer tools?

[aboodman]

The argument would be that the custom build of Chrome (or other malicious software) is harder to create, but not so much harder so as to be not worth doing for the attacker.