Is Copy and Paste more safe?
Copy and Paste more is low risk. The content script listens for copy events on every HTTP/HTTPS page, reads the clipboard a second later, and relays it to the worker, storing it in chrome.storage.local, even for passwords. A test marker was stored; history stays on-device.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Reads clipboard on every copy across all websites into a local history
The content script listens for copy events on every HTTP/HTTPS page, reads the clipboard a second later, and relays it to the worker, storing it in chrome.storage.local, even for passwords.
A test marker was stored; history stays on-device.
You copy text on any website.
A copy event fires on the page, which can include sensitive text such as a password you copied from a manager or a form field.
The extension reads the clipboard back one second later and saves the value to a clipboard history.
It re-reads the clipboard through an off-screen text area, relays the value to its background service worker, and appends it to a history stored on the device.
Content script reads the clipboard after each copy, relaying it to the background, which stores it.
// Read whatever is currently in the clipboard via an off-screen textarea
function readClipboard() {
const scrollY = window.pageYOffset || document.documentElement.scrollTop;
const ta = document.createElement('textarea');
ta.style.position = 'absolute';
ta.style.left = '-10000px';
ta.style.top = '-10000px';
document.body.appendChild(ta);
ta.focus();
document.execCommand('paste'); // pastes current clipboard into the textarea
const value = ta.value;
document.body.removeChild(ta);
window.scrollTo(0, scrollY);
return value;
}
const port = chrome.runtime.connect({ name: 'callFromContentScript' });
// On every copy event, wait 1s then read the clipboard and send it to the background
document.addEventListener('copy', function (e) {
setTimeout(function () {
const value = readClipboard();
port.postMessage({ method: 'clipboard', value: value });
}, 1000);
});// Receive clipboard values from the content script and append to history
if (port.name === 'callFromContentScript') {
port.onMessage.addListener(function (msg) {
if (msg.method === 'clipboard' && msg.value !== undefined) {
const history = store.getState().data.copy_paste;
let alreadyPresent = false;
history.forEach(function (item) { if (item === msg.value) alreadyPresent = true; });
if (!alreadyPresent) {
store.dispatch({ type: 'ADD_COPY_PASTE', data: msg.value });
}
}
});
}Every 50 seconds the background service worker writes the entire accumulated clipboard history to chrome.storage.local under the key 'copy_paste', so copied items persist on the device across sessions.
A marker copied on Wikipedia was read and stored in local history, shown here. Real passwords would be retained the same way.
chrome.storage.local key 'copy_paste'["<planted marker value>"]
Steps to reproduce the clipboard capture and confirm the copied value lands in the extension's local clipboard history.
# 1. Load the extension and open any https page, e.g. https://en.wikipedia.org
# 2. Select and copy a unique marker string, e.g.:
MARKER="MARKER_$(date +%s)_secretpw"
echo "$MARKER" # copy this value to the clipboard on the page
# 3. Wait 2 seconds, then open the extension popup -> clipboard history tab.
# The marker should appear in the list.
# 4. Confirm it is persisted by inspecting chrome.storage.local in the
# service worker DevTools console:
# chrome.storage.local.get('copy_paste', r => console.log(r.copy_paste))
# -> the array should contain your marker string.- 1Load the extension and open any https page.
- 2Copy a unique marker string.
- 3Wait ~2s and open the popup history tab.
- 4Inspect chrome.storage.local key 'copy_paste' in the service worker console to confirm the marker is stored.
Code analysis and dynamic analysis indicate the clipboard history is kept on the device in chrome.storage.local and rendered in the extension popup. No captured network request contained the copied marker value, so this finding is about broad, persistent clipboard capture and local retention across every site, not remote exfiltration. The one-second delay also means the value read can differ from the exact text just copied if the clipboard changes within that window.