Android’s Clipboard Warning Can Be Hidden, and Google Has Closed the Report

How the Warning Gets Hidden

Android has limited the clipboard in two steps. Since Android 10, only the app you have open and your keyboard can read it; apps in the background can’t. Since Android 12, a short message at the bottom of the screen says “APP pasted from your clipboard” when an app reads clip data from another app.

That message is a toast, the small grey bubble Android uses for brief notices. It disappears by itself after a few seconds, and it is the only sign you get. Noble didn’t think an easy-to-miss bubble was enough for something this sensitive, and then he found it was not even reliable.

His test app reads the clipboard when it opens and every time you switch back to it. Right after each read, it shows two toasts of its own, “Welcome to Toni’s Clip Test App!” and “Have fun :)”. In the recording on his blog, these two appear and Android’s warning doesn’t.

The code uses the standard clipboard function and the standard toast that any app may show. It asks for no special permission. To you, an app doing this looks like an app saying hello.

Noble’s post doesn’t say which Android version or phone he ran it on.

What Google Told Him

Noble wrote up the bug at the end of July and held the post back while Google looked at it. The reply he published is dated 12 November. It sets the status to “Won’t Fix (Infeasible)”, rates the vulnerability Moderate and says it “will be passed to the feature team for remediation”.

The same message says Moderate issues are “typically addressed in a potential upcoming release”, that Google won’t send further updates and that the submission is closed. Moderate is the second-lowest of the four ratings Google uses for Android bugs.

Noble calls the outcome a Won’t Fix. Google’s wording leaves the door open for a fix in some later release. For your phone today, that changes nothing. There is no patch, no date and no public way to follow the issue.

This is not the first way around the warning. In October 2023, Fingerprint showed that an app can draw over the toast, but that trick needs the “display over other apps” permission. In May 2024, Google patched CVE-2024-23708, “a possible way to not show a toast message when a clipboard message has been accessed”, and rated that one High.

So the 2024 way of hiding the warning was rated High, and this one, which needs no permission at all, is Moderate. Google hasn’t said publicly what makes the difference.

What an App Could Read

Think of what you copy on a phone. Passwords from a password manager, one-time codes from an authenticator app, bank account numbers, crypto wallet addresses, sometimes a recovery phrase. Google’s own guidance for developers says the risk of clipboard leaks is especially high for financial apps and apps that handle two-factor codes.

Android 13 added a flag that hides sensitive content in the preview that pops up when you copy. Google Authenticator uses it, Noble notes, but the flag only hides the code from people looking at your screen. Other apps can still read the value.

The attack has one real limit. The app must be installed and open on your screen, so it can’t grab your clipboard from the background. What it can do is wait for you. You copy a code, switch to another app for a moment, and that app reads it.

Apps reading the clipboard is not a theory. In 2023, Microsoft found that an old version of the SHEIN shopping app read the Android clipboard and, when it saw a certain pattern, sent the contents to a remote server. Microsoft said it wasn’t aware of malicious intent, and SHEIN removed the behaviour.

Since Android 13, the system clears the clipboard by itself after about an hour. For an attack that needs a second, an hour is plenty.

How to Keep What You Copy Away From Other Apps

You can’t turn this bug off, but you can copy less and keep copied secrets short-lived.

• Let your password manager fill, not copy. Autofill puts the password straight into the login field without using the clipboard. Check options that copy anyway: Bitwarden’s “Copy TOTP automatically”, for example, puts your two-factor code on the clipboard after an autofill.
• Turn on automatic clipboard clearing in your password manager. In Bitwarden’s Android app it’s under Settings, Other, Clear clipboard; other managers have a similar option.
• Check your keyboard’s clipboard history. The keyboard is the one app Android always lets read the clipboard, and it keeps its own copy. Gboard deletes unpinned items after an hour; you can remove a password there by hand or turn clipboard history off in Gboard’s settings.
• Overwrite secrets. Android’s clipboard holds one item at a time, so copying a harmless word after you paste a password removes it (from the system clipboard, not from a keyboard’s history).
• Go straight to where you paste. After copying a code or password, don’t open anything else on the way.
• Leave “Show clipboard access” on. It’s on by default; search Settings for “clipboard” to check. It won’t catch this trick, but it still catches apps that don’t use it.
• If you run GrapheneOS on a Pixel, its Secure Paste feature lets you block clipboard reads per app. Apps then can’t read what you copied elsewhere unless you paste it yourself. Some banking apps don’t run on GrapheneOS, as the Wero case at ASN Bank showed.

What Noble Wants Google to Do

Noble has asked Google for a real clipboard permission on Android, one you grant or refuse per app, like location or notifications. He asks people who agree to upvote the request.

iPhones have had something close to it since iOS 16. An app that wants to read what you copied in another app has to ask with an “Allow Paste” prompt, and since iOS 16.1 you can set “Paste from Other Apps” to Ask, Deny or Allow for each app. GrapheneOS shows the same can be done on Android.

A warning that any app can cover with a cheerful “Have fun :)” is, let us say, not the strongest lock on the door. A permission would be one.