Am I Being Pwned?
Get started

Is Copy and Paste more safe?

Low risk

Copy and Paste more is low risk. The content script listens for copy events on every HTTP/HTTPS page, reads the clipboard a second later, and relays it to the worker, storing it in chrome.storage.local, even for passwords. A test marker was stored; history stays on-device.

satoshiho2012v5.0Chrome Web Store
18Risk
Who publishes it

satoshiho2012 - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
satoshiho2012

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

ScreenShot To Text More1k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Reads clipboard on every copy across all websites into a local history

HighunwantedCWE-506Dynamic sandbox

The content script listens for copy events on every HTTP/HTTPS page, reads the clipboard a second later, and relays it to the worker, storing it in chrome.storage.local, even for passwords.

What actually happens

You did this

You copy text on any website.

A copy event fires on the page, which can include sensitive text such as a password you copied from a manager or a form field.

The extension did this

The extension reads the clipboard back one second later and saves the value to a clipboard history.

It re-reads the clipboard through an off-screen text area, relays the value to its background service worker, and appends it to a history stored on the device.

The code that does this

Content script reads the clipboard after each copy, relaying it to the background, which stores it.

Readable version
// Read whatever is currently in the clipboard via an off-screen textareafunction readClipboard() {  const scrollY = window.pageYOffset || document.documentElement.scrollTop;  const ta = document.createElement('textarea');  ta.style.position = 'absolute';  ta.style.left = '-10000px';  ta.style.top = '-10000px';  document.body.appendChild(ta);  ta.focus();  document.execCommand('paste');   // pastes current clipboard into the textarea  const value = ta.value;  document.body.removeChild(ta);  window.scrollTo(0, scrollY);  return value;}const port = chrome.runtime.connect({ name: 'callFromContentScript' });// On every copy event, wait 1s then read the clipboard and send it to the backgrounddocument.addEventListener('copy', function (e) {  setTimeout(function () {    const value = readClipboard();    port.postMessage({ method: 'clipboard', value: value });  }, 1000);});
// Receive clipboard values from the content script and append to historyif (port.name === 'callFromContentScript') {  port.onMessage.addListener(function (msg) {    if (msg.method === 'clipboard' && msg.value !== undefined) {      const history = store.getState().data.copy_paste;      let alreadyPresent = false;      history.forEach(function (item) { if (item === msg.value) alreadyPresent = true; });      if (!alreadyPresent) {        store.dispatch({ type: 'ADD_COPY_PASTE', data: msg.value });      }    }  });}

When this fires

Every 50 seconds

Every 50 seconds the background service worker writes the entire accumulated clipboard history to chrome.storage.local under the key 'copy_paste', so copied items persist on the device across sessions.

What's stored on your device

A marker copied on Wikipedia was read and stored in local history, shown here. Real passwords would be retained the same way.

Location
chrome.storage.local key 'copy_paste'
Contents
[  "<planted marker value>"]

Reproduce it yourself

Steps to reproduce the clipboard capture and confirm the copied value lands in the extension's local clipboard history.

Requires
  • Chrome with the extension loaded unpacked
verify_clipboard_history.md · sh
# 1. Load the extension and open any https page, e.g. https://en.wikipedia.org# 2. Select and copy a unique marker string, e.g.:MARKER="MARKER_$(date +%s)_secretpw"echo "$MARKER"   # copy this value to the clipboard on the page# 3. Wait 2 seconds, then open the extension popup -> clipboard history tab.#    The marker should appear in the list.# 4. Confirm it is persisted by inspecting chrome.storage.local in the#    service worker DevTools console:#    chrome.storage.local.get('copy_paste', r => console.log(r.copy_paste))#    -> the array should contain your marker string.
How to run it
  1. 1Load the extension and open any https page.
  2. 2Copy a unique marker string.
  3. 3Wait ~2s and open the popup history tab.
  4. 4Inspect chrome.storage.local key 'copy_paste' in the service worker console to confirm the marker is stored.

History is retained locally; no remote transmission was observed

Code analysis and dynamic analysis indicate the clipboard history is kept on the device in chrome.storage.local and rendered in the extension popup. No captured network request contained the copied marker value, so this finding is about broad, persistent clipboard capture and local retention across every site, not remote exfiltration. The one-second delay also means the value read can differ from the exact text just copied if the clipboard changes within that window.

What it can do

Permissions this extension asks for, as declared in version 5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls> and 1 more

  • Read and change your data on every secure site you visit

    https://*/*

  • Store data in your browser

    storage

  • Write to your clipboard

    clipboardWrite

  • Read whatever you have copied to your clipboard

    clipboardRead

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026mjijaapcbpbcppapekipkdhipfcdpidb