The dangers of web apps or websites maliciously accessing my clipboard?

Question

Is there a danger of my clipboard data being harvested by a web app or site that I visit?

I would like to stay safe, but I want to keep JavaScript enabled to give a better user experience.

Answer 1

Most modern browsers will not allow JavaScript to access your clipboard without at least a warning. It's plugins such as Flash that you need to worry about.

For more information, see MozillaZine's article which states:

By default, JavaScript is not allowed to read or set your clipboard data for security and privacy reasons. This is because websites scripts can erase and replace what you currently have in your clipboard (data loss issue) and they can read whatever you have in your clipboard (security and privacy issue); as such, you should grant access with caution.

There are extensions such as AllowClipboard Helper for Firefox which should let you decide exactly which sites have access to your clipboard.

Answer 2

Yes there is definitely a danger that websites can access your clipboard data.

On desktop browsers, it may be true that this can happen only if you have granted permission or dismissed a warning dialog. But while the permission may have been granted at a particular moment for a particular purpose, the permission lingers beyond that particular moment and purpose, granting the website the ability to read your clipboard whenever the document is focused.

So for instance:

• you grant a web page permission to paste a cat image to a meme generator.
• you change tabs to your bank's website, and copy/paste your password to login.
• you return to the cat page to see the meme.
• The meme generator site can see the bank password in the clipboard contents.

For mobile devices, it appears that the clipboard is accessible to any application

https://avoidthehack.com/how-secure-is-your-copied-text