If you've convinced your victim to install a Chrome Extension, they're already way more hosed than anything you might do with a fake iMessage popup.