There’s been plenty of talk this week about Google Chrome Frame, which bolts Chrome’s shininess onto the Internet Explorer 8 undercarriage. Google says, “it’s all about bringing a better, more standards-forward browsing experience to users.”

Microsoft says “hey, that thing just give malware more attach points and makes our browser less secure” — which cause a lot of chuckling around the blogosphere. After all, Chrome is a pretty secure browser and was the only one not to fall at Pwn2Own this year.

However, as Sophos Labs’ Mike Wood points out, there’s one big, nasty side effect that hasn’t been talked about: social engineering malware.

Attacks offering fake AV codecs are still commonplace. Recently a fake Flash plugin for Firefox was spotted — and we’ve all seen the numerous fake antivirus apps for Windows floating around out there.

So how long will it be before someone decides to inject a bogus “you need Google Chrome Frame” popup on some compromised website? There was a time when attacks like this were mostly limited to porn and warez sites, but nowadays it could even occur on a legitimate one like the New York Times.

No, it won’t be long before this happens and people start being duped into a malicious install. And when the proverbial sh*t hits the fan, scores of users and technicians who don’t know better are gong to blame IE8 for not being secure enough and recommend a browser switch.

Whether or not Google planned it that way (I’m going to go with not), this could turn Chrome Frame into a much bigger kick in the nuts for Internet Explorer than first thought.