If you where using LastPass, and visited any page controlled by an attacker on any domain, they could get your passwords to all sites that they tested for, for example twitter, gmail etc.