Ordinary Android Apps Can Hide Clipboard Access Warnings Without Special Permission
Summary
Software engineer Toni Noble demonstrated that an ordinary Android app can read the clipboard and suppress Android’s access toast by showing its own. Google rated the report Moderate and closed it; no fix or release date is available.
Key points
- Noble's test app reads the clipboard and immediately displays its own toasts, preventing Android's clipboard-access warning from appearing.
- The method uses standard clipboard and toast functions and requires no special permission; the app must be installed and open on screen.
- Noble did not specify the Android version or device used in his demonstration.
- Google rated the report Moderate and closed it as “Won’t Fix (Infeasible),” while saying it would pass the issue to the feature team; no patch or timeline was announced.
- Android 13's sensitive-content flag hides clipboard previews from people looking at the screen, but does not prevent other apps from reading the copied value.
- The article recommends using autofill, clearing or overwriting clipboard contents quickly, and avoiding opening other apps after copying secrets; GrapheneOS Secure Paste can block reads per app.
Article Details
- Vulnerability Types
- Android clipboard access warning suppression using toast messages
- Severity
- Moderate
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Use password-manager Autofill instead of copying passwords.
- After copying a secret, switch directly to the app where you will paste it without opening another app.
- Enable automatic clipboard clearing in your password manager.
- On GrapheneOS, use Secure Paste to block clipboard reads per app unless you paste the content yourself.