Is Copy and Paste more safe?

Low risk

Copy and Paste more is low risk. The content script listens for copy events on every HTTP/HTTPS page, reads the clipboard a second later, and relays it to the worker, storing it in chrome.storage.local, even for passwords. A test marker was stored; history stays on-device.

satoshiho2012v5.0Chrome Web Store
20Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Reads clipboard on every copy across all websites into a local history

The content script listens for copy events on every HTTP/HTTPS page, reads the clipboard a second later, and relays it to the worker, storing it in chrome.storage.local, even for passwords.

A test marker was stored; history stays on-device.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You copy text on any website.

A copy event fires on the page, which can include sensitive text such as a password you copied from a manager or a form field.

The extension did this

The extension reads the clipboard back one second later and saves the value to a clipboard history.

It re-reads the clipboard through an off-screen text area, relays the value to its background service worker, and appends it to a history stored on the device.

02EvidenceCODE COMPARE
The code that does this

Content script reads the clipboard after each copy, relaying it to the background, which stores it.

What it actually does
// Read whatever is currently in the clipboard via an off-screen textarea
function readClipboard() {
  const scrollY = window.pageYOffset || document.documentElement.scrollTop;
  const ta = document.createElement('textarea');
  ta.style.position = 'absolute';
  ta.style.left = '-10000px';
  ta.style.top = '-10000px';
  document.body.appendChild(ta);
  ta.focus();
  document.execCommand('paste');   // pastes current clipboard into the textarea
  const value = ta.value;
  document.body.removeChild(ta);
  window.scrollTo(0, scrollY);
  return value;
}

const port = chrome.runtime.connect({ name: 'callFromContentScript' });

// On every copy event, wait 1s then read the clipboard and send it to the background
document.addEventListener('copy', function (e) {
  setTimeout(function () {
    const value = readClipboard();
    port.postMessage({ method: 'clipboard', value: value });
  }, 1000);
});
// Receive clipboard values from the content script and append to history
if (port.name === 'callFromContentScript') {
  port.onMessage.addListener(function (msg) {
    if (msg.method === 'clipboard' && msg.value !== undefined) {
      const history = store.getState().data.copy_paste;
      let alreadyPresent = false;
      history.forEach(function (item) { if (item === msg.value) alreadyPresent = true; });
      if (!alreadyPresent) {
        store.dispatch({ type: 'ADD_COPY_PASTE', data: msg.value });
      }
    }
  });
}
03EvidenceTEMPORAL PATTERN
When this fires
Every 50 seconds

Every 50 seconds the background service worker writes the entire accumulated clipboard history to chrome.storage.local under the key 'copy_paste', so copied items persist on the device across sessions.

04EvidenceSTORAGE DUMP
What's stored on your device

A marker copied on Wikipedia was read and stored in local history, shown here. Real passwords would be retained the same way.

Locationchrome.storage.local key 'copy_paste'
Contents
["<planted marker value>"]
05EvidenceARTIFACT
Reproduce it yourself

Steps to reproduce the clipboard capture and confirm the copied value lands in the extension's local clipboard history.

RequiresChrome with the extension loaded unpacked
verify_clipboard_history.md · sh
# 1. Load the extension and open any https page, e.g. https://en.wikipedia.org
# 2. Select and copy a unique marker string, e.g.:
MARKER="MARKER_$(date +%s)_secretpw"
echo "$MARKER"   # copy this value to the clipboard on the page

# 3. Wait 2 seconds, then open the extension popup -> clipboard history tab.
#    The marker should appear in the list.

# 4. Confirm it is persisted by inspecting chrome.storage.local in the
#    service worker DevTools console:
#    chrome.storage.local.get('copy_paste', r => console.log(r.copy_paste))
#    -> the array should contain your marker string.
How to run it
  1. 1
    Load the extension and open any https page.
  2. 2
    Copy a unique marker string.
  3. 3
    Wait ~2s and open the popup history tab.
  4. 4
    Inspect chrome.storage.local key 'copy_paste' in the service worker console to confirm the marker is stored.
06EvidencePLAIN NOTE
History is retained locally; no remote transmission was observed

Code analysis and dynamic analysis indicate the clipboard history is kept on the device in chrome.storage.local and rendered in the extension popup. No captured network request contained the copied marker value, so this finding is about broad, persistent clipboard capture and local retention across every site, not remote exfiltration. The one-second delay also means the value read can differ from the exact text just copied if the clipboard changes within that window.

Updated 17 September 2026mjijaapcbpbcppapekipkdhipfcdpidb