A bug in Chrome that allows you to change the clipboard without user action

Recent releases of the Chromium engine have changed behavior related to writing to the clipboard. While in Firefox, Safari, and older releases of Chrome, writing to the clipboard was allowed only after explicit user interaction, in newer releases, writing to the clipboard is as simple as opening the site. The change in behavior in Chrome is due to the need to read data from the clipboard when displaying the Google Doodle splash screen on the new tab page (instead of specifically handling this situation, Chromium simply allowed all sites to write to the clipboard without the user activating this operation).

The write capability works when calling the navigator.clipboard.write (example) and navigator.clipboard.writeText (example) methods, which no longer take into account user activity on the page. For example, to write to the clipboard immediately after opening the site, it is enough to execute the following JavaScript code: navigator.clipboard.writeText('Hello from the web page.'); lettype='text/plain'; let blob = new Blob(['Hello from web page'], { type }); let item = new ClipboardItem({ [type]: blob }); navigator.clipboard.write([item]);

Source: opennet.ru

Add a comment