Clipboard hijacking in the browser

How it usually happens in the browser

• A malicious site or extension requests clipboard permissions or exploits permissive browser behaviors.
• The attacker reads clipboard contents (secrets, tokens) or overwrites pasted values (payment info, wallet addresses).
• Victims paste into finance, cloud, or dev tools assuming the value is unchanged.
• The attacker profits from redirected transfers or harvested credentials/secrets.

What traditional defenses miss

• Clipboard access can be legitimate for some apps, so blanket blocking is hard without policy and user experience work.
• Users rarely verify long strings after paste.
• The attack can be subtle and doesn’t require dropping a traditional executable.

How isolation changes the game

• Isolation reduces exposure to untrusted sites that request clipboard access and contains risky browsing away from endpoints.
• Policy can restrict clipboard permissions more aggressively for unknown destinations and isolated sessions.
• Session deletion reduces residual state from risky browsing, limiting follow-on tracking and exploitation.

Operational checklist

• Restrict clipboard permissions via enterprise browser policy; deny by default for unknown sites.
• Enforce extension allowlists and audit extensions that request clipboard access.
• For finance workflows, add out-of-band verification for payee/payout changes.
• Isolate unknown destinations to reduce exposure to permission-request lures.
• Educate teams handling secrets (engineering, IT): avoid pasting sensitive tokens into untrusted web forms.

FAQs.