If we compare these two - google password manager vs lastpass, which is better?

You are asking which is better between Google Password Manager vs Lastpass and about how to be secure under the assumption that a malicious actor has started a process on your system (or hijacked another process with their own code) running with "user trust".On Windows, you could trigger this action yourself by -- for example -- downloading http://example.com/virus.exe and then running it voluntarily. Even if you are never asked for a UAC prompt, your system is still effectively compromised. On Linux, you could trigger this action by downloading a binary (or even a shell script, Ruby script, Python script, Java jar, etc), making it executable, and running it.

The security model of most OSes -- especially those which have not been very specifically configured with a strict Mandatory Access Control policy, which they almost never are out of the box for convenience -- is unable to mitigate a compromise at this level. The following potential attack vectors immediately present themselves on Windows, Mac OS X, desktop GNU/Linux, desktop BSD, Android, iOS, etc., assuming a malicious actor is able to run some form of code with user trust on the system/device: Mouse/Keyboard capture or injection: capturing keystrokes, mouse movements/clicks, or injecting the attacker's own keyboard/mouse actions.

Screen scraping or injection: capturing screenshots or video of the display output, or injecting the attacker's own arbitrary data to the screen to make you think you're doing one thing while actually doing another.Web browser hijacking: stealing session cookies and uploading them to a remote server.Arbitrary reads of any data on your filesystem that you can access manually as a user, and sending that data to the attacker's server. Using published or unpublished exploits at the system API layer (C library, security libraries, authentication libraries, kernel interface, etc.) to elevate permissions from user to administrator level, and then perform more advanced compromise techniques (rootkits, etc.) that aren't typically possible as a regular user, to further exfiltrate data or confuse the user into typing their passwords or personal information, which is then keylogged and exfiltrated

Given this list of possible attack vectors, and probably others I'm missing, it is impossible for any "password manager" to actively prevent any/all of these methods from being exploited to either steal your data, or make you think you're at a legitimate website where you then unwittingly submit your credentials or personally-identifiable info to the attacker. Let's put it this way: if Cross-Site Request Forgery and Cross-Site Scripting or Heartbleed are comparable to having your front door wide open, trying to have any meaningful security within a password manager under a scenario of malicious program(s) running under user trust is like trying to sleep peacefully when you can see a robber in your bedroom who's rifling through your personal valuables and putting interesting ones in a big bag.