I'm a little skeptical that this is a real exploit.
When I watched the Salesforce video, the exploit was demonstrated by pointing the browser at a file on disk, not on a public website. I also don't understand the "proof," IE, something showed up in the salesforce inbox, but I don't understand how that shows that the user was hacked. It appears to be an automated email from an identity provider.
I also don't understand when the popup is shown, and what the element is when the popup is closed.
Some slow-mo with highlighting on the fake window, and the "proof of exploit," might make this easier to understand and demonstrate
replies(2):