Intercepting the plaintext of the communications to the server isn't sufficient since the password is sent to the server after being hashed and the plaintext is encrypted. It may provide the basis for an attack but in itself it doesn't break the second layer of security.

Ironically, this is an advantage of having a second layer of cryptography in the browser. It forces an attacker to do significantly more work to acquire the data passively or requires an active attack.