Not that risky? This active attack is pretty easy to detect. If you fake a google cert, and chrome hits it (highly likely) game over for you.