Unless your password manager displays a popup to be unlocked. Then that's spoofable too. Which is why I paranoidly move the popup to overlap the URL bar before unlocking.