Attack doesn't seem to actually work. Unless I'm missing something? Tried it in incog mode too, nothing, js doesn't run.

Looking in the console it says:

Blocked opening 'http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=ht... in a new window because the request was made in a sandboxed frame whose 'allow-popups' permission is not set.

So the attack doesn't seem to work in Chrome.

NB: Just tested on FF, works on that.

Also homakov, I had to edit the iframe width/height just to be able to see the link in the first place because google's putting all the login stuff at the top, I'd suggest setting the height to 300px instead of 30px. Are you running something which stops that showing in your browser?