Is MultiCopy Clipboard, Copy & Paste safe?
We analyzed MultiCopy Clipboard, Copy & Paste version 5.0.0's actual code and gave it a 38/100 trust score. This clipboard extension has broad access and…
Bottom line
This clipboard extension has broad access and a serious page-to-extension weakness that can expose saved clipboard text to hostile websites.
What it can access
It runs on every website and reads editable fields, including password fields, while providing clipboard features beyond a narrowly scoped page need.[Q1][Q3][Q15]
Security weaknesses
Hostile websites can trigger privileged clipboard retrieval and place saved text into page-owned fields because events are not checked as genuine user actions.[Q16][Q21][Q24]
Signs of misuse
No publisher server collection was found, but any visited page may induce clipboard disclosure through the extension’s page integration.[Q6][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs a page access on every URL and can inject scripts into the active tab. Clipboard-manager features explain page access, but the always-on scope exposes sensitive state to every visited site.
Runs command-handler.js on <all_urls> and declares activeTab plus scripting. — manifest.json:13-23, 48-55
Injects copy-handler.js or paste-handler.js into the active page after shortcut or context-menu actions. — background.js:73-95, 178-251
Which websites can it run on, and can it read or change what appears on those pages?
On every website it appends an autocomplete dropdown, monitors editable elements and can replace field or content-editable text with saved clipboard content.
Appends an extension-controlled dropdown directly to document.body and fills it with copy previews. — command-handler.js:28-59, 149-225
Replaces command text inside website fields and registers document-wide input/keyboard listeners. — command-handler.js:453-490, 664-681
Directly edits inputs, textareas and content-editable DOM and dispatches input/change events. — paste-handler.js:57-159
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The always-on input listener reads edited text, email, URL, telephone and password fields to find commands. It does not upload those field values, but its code has access to them on every site.
Reads element.value on each input event and explicitly includes password inputs in supported editable types. — command-handler.js:256-289, 562-610
Registers the input listener document-wide in capture phase. — command-handler.js:670-673
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Permissions omit cookies, history, bookmarks and downloads. — manifest.json:48-55
Stores and retrieves copies in a local extension IndexedDB database. — storage.js:6-58, 128-206
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A fallback paste path writes the chosen saved text to the system clipboard. No location, camera, microphone, local-file or installed-app access was found.
Uses navigator.clipboard.writeText only as a last-resort paste method. — paste-handler.js:161-186
No device, file or management permissions are declared. — manifest.json:48-55
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No publisher server receives saved data, but the command interface can disclose clipboard entries into any visited website's page. A hostile page can then read the injected preview or full inserted value.
Places saved-copy preview text into DOM nodes appended to the host page. — command-handler.js:149-225
Places the full selected copy into the host page's input value. — command-handler.js:419-465
Synthetic input can invoke the flow because handlers do not require event.isTrusted. — command-handler.js:562-595, 664-681
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All runtime scripts are packaged locally and no remote host permission is requested. — manifest.json:1-56
Background logic contains no fetch, XMLHttpRequest or WebSocket operation. — background.js:1-307
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It loads the complete copy database into every page immediately and every five seconds without a user request. A page-generated input event can then trigger rendering and insertion without a trusted user gesture.
Calls getCopies at initialization and at five-second intervals on every page. — command-handler.js:547-559, 664-681
Handles any input event without checking isTrusted. — command-handler.js:562-595
Option click handling also omits an isTrusted check. — command-handler.js:210-219
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No setting-control permission or browser override is declared. — manifest.json:1-56
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Security-relevant page behavior is present as readable, commented source. — command-handler.js:1-692
Loads named local UI, storage, jQuery and Material Design assets. — index.html:1-240
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No dynamic execution primitive is used. — background.js:1-307
Timers receive packaged functions; stored text is inserted as text, not code. — command-handler.js:1-692
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Returns source URL, title and scroll position alongside an explicitly selected copy. — copy-handler.js:214-245
Saves that metadata only to local IndexedDB. — background.js:18-69
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
IndexedDB auto-increment IDs identify local copy records, not users and are never transmitted. — storage.js:178-205
Does it send cookies, session details, authentication data, or page contents elsewhere?
It does not extract cookies or upload page contents, but saved clipboard text can be exposed to an arbitrary visited page through the shared autocomplete page and field insertion path.
Renders stored clipboard text into host-page DOM and input values. — command-handler.js:149-225, 419-465
No cookies permission or network host access is declared. — manifest.json:48-55
Does it record typing, form entries, clipboard contents, or screenshots?
It monitors input events across all sites, including password fields, to recognize commands; reads selected field/page text on explicit copy actions; and inserts saved text into editable elements. It does not capture screenshots.
Reads values of supported editable fields, explicitly including password inputs, on document-wide input events. — command-handler.js:256-289, 562-610, 670-673
Extracts explicitly selected text from active inputs, textareas and page selection. — copy-handler.js:6-57, 60-73
Inserts saved text and dispatches input/change events. — paste-handler.js:57-159
Can a website or remote server send commands that make the extension take actions?
A hostile website can indirectly command the page access by dispatching synthetic input and click events. That causes privileged clipboard retrieval and full-copy insertion despite no real user action.
Document event handlers accept synthetic input and retrieve extension-only storage through runtime messaging. — command-handler.js:562-595, 664-681
A synthetic option click selects and inserts full stored copy text without event trust validation. — command-handler.js:210-219, 419-465
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Injected DOM is limited to the clipboard-command dropdown. — command-handler.js:28-225
Feedback and donation links are fixed, visible popup actions. — main.js:10-15
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No proxy, webRequest, declarativeNetRequest or downloads permission is declared. — manifest.json:48-55
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or local-service host permission exists. — manifest.json:1-56
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads only packaged storage, copy and paste scripts. — background.js:1-307
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites can drive the always-on page access through shared page events and then read clipboard text the extension places into shared page or a page-owned input. This is an exploitable page-to-extension privilege bridge.
Installs command-handler.js on every URL. — manifest.json:13-23
Clipboard previews are appended to document.body, which is shared with the host page. — command-handler.js:149-225
Untrusted DOM events can select a copy and place its full value in a page-owned input. — command-handler.js:419-465, 562-595
The getCopies message returns the complete copy database without checking sender context. — background.js:253-276
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The same handler initializes on every matching page as soon as the DOM is ready. — command-handler.js:664-692
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The only recurring task refreshes saved copies every five seconds. — command-handler.js:675-681
Does it change form fields or where a form sends its information?
It intentionally replaces text in inputs, textareas and content-editable elements and dispatches framework-visible input/change events. It does not change form action URLs, but the untrusted event path lets a page trigger insertion of saved secrets.
Writes saved text into website fields or rich editors and emits input/change events. — paste-handler.js:57-159
Replaces typed command text with full saved clipboard content. — command-handler.js:453-490
Command activation lacks an isTrusted requirement. — command-handler.js:562-595