Attacking Vision-Language Computer Agents via Pop-ups