Clipboard access only triggered by explicit user action

Clipboard content is among the most sensitive data on a user's device — it regularly contains passwords copied from password managers, 2FA codes, API keys, banking account numbers, and confidential text. An extension that reads the clipboard automatically, periodically, or on page load captures this data without any user signal that the action is happening. CWE-200 covers unauthorized data exposure; GDPR Art. 5(1)(c) requires collection to be limited to what is necessary and tied to a specific purpose. Chrome Web Store policy requires clipboardRead access to be justified by core functionality — background clipboard monitoring is explicitly prohibited.

Ensure all clipboard reads are initiated by an explicit user gesture. Attach the read to a button click or keyboard shortcut, never to load or interval events:

document.getElementById('pasteButton').addEventListener('click', async () => {
  try {
    const text = await navigator.clipboard.readText();
    processText(text);
  } catch (err) {
    console.error('Clipboard read failed:', err);
  }
});

// NEVER do this:
// setInterval(() => navigator.clipboard.readText().then(log), 30000);
// window.addEventListener('load', () => navigator.clipboard.readText()...);

If you need to monitor clipboard for a specific feature, surface a dedicated UI control that the user must actively engage with each time.