It should appear a second after the page seems to have finished loading, so that it hijacks the input if the user is navigating with the keyboard or typing something into a form.

Or even better, something that pretends to be a real "Sign in with Google" button but instead phishes your username and password.

It also needs to ask the browser for your location and to send you notifications.

Notifications?

How about an email popup. My browser will happily auto-populate it.