I kinda like feeding trolls, and you know if walks like a troll and it quacks like a troll, then you be needing feeding.

The upper frame is the problem here, if the person can get that to not display, then fine there is grounds for concern, though HTTPS is the thing you should be looking at.

And I suspect they cannot drop the top frame, so is it a problem? I would imagine anyone trying it on would get detected by Google who would probably prosecute.

Oh and just so you know, there is a loose and fast league of ACs around these parts, an attack on one is an attack on all, think of us as being like NATO.