Comment by level3

But does the page even need to get you to enter it? Could it be possible to set up a hidden password field for LastPass to monitor, and then run a dictionary attack in the background, waiting for the notification?

(I don't use LastPass, so I don't know anything about how this feature is designed.)