Newshot NOTE: This blog was originally written at the end of the July 2026 but publishing was held off pending Android Security Team bug resolution. Since I have received update that this CVE of Moderate severity is now a Won't Fix I am disclosing the details publicly.
Slack's brush-knock notification cuts through the Lo-fi Beats to Study & Relax To, forcing your pupils up and to the right, consuming a truncated message from your coworker.
"Lemme know when you've copied it," they say following a sixteen-character string with mixed letters, digits, and symbols. "Thanks!"
You grab your phone, open Slack, copy the support team's superuser password, navigate to the company's SaaS application and successfully login.
"All set!" you reply, and within seconds the line above mutates to This message has been deleted by its author
Google's documentation on Secure Clipboard Handling offloads the responsibility of safely copying sensitive content to application developers, while also stating that other app developers may operate as potential threat actors:
Additionally, in order to protect PII (Personal Identifiable Information), Android supports the ClipDescription.EXTRA_IS_SENSITIVE or android.content.extra.IS_SENSITIVE special flag. This allows developers to visually obfuscate the clipboard content preview within the keyboard GUI, preventing copied data from being visually shown in clear-text and potentially stolen by malicious applications. Not implementing one of the aforementioned flags could in fact allow attackers to exfiltrate sensitive data copied to the clipboard by either shoulder surfing or through malicious applications that, while running in background, take screenshots or record videos of a legitimate user's activities.
Authenticator, Google's MFA token Android application, leverages this functionality when codes are copied. If someone is hovering within eyeshot of your device they won't see the secret when your keyboard opens, but the value is still readable to other applications.
Since Android 10 background clipboard access has been disallowed, and applications looking to capture the screen require explicit permission each and every time (unless the recording app is signed with the same key as the Android OS itself). So what if you open an application that reads your superuser credential copied from Slack?
From Android 12 onwards (API level 31), every time an application accesses data within the clipboard and pastes it, a toast message is shown to the user, making it more difficult for attacks to go unnoticed.
I didn't find an automatically-dismissed and easy-to-miss toast notification sufficient for a potentially sensitive operation, so I opened a feature request in IssueTracker to support clipboard access control with per-app permissions, similar to Location or Notification settings. As a sidenote, if you feel similarly then I encourage you to +1 the issue.
Some weeks back I installed Android Studio and forked the Android Meshtastic app repo, as I intended to submit a fix for a notification timestamp bug, but was unable to reproduce the bogus behavior. With Android development tools readily available and front-of-mind I had an idea: can we obfuscate the clipboard read toast notification, leaving the user completely unaware that copied content was accessed?
Using a simple Android test application I was able to bypass the clipboard read security measure, rapidly triggering two developer-created toast notifications that display instead of the message alerting the user that their clipboard was read from:
Nefarious application developers could then use Open Source Intelligence, or OSINT, to determine the associated account name, or sell the secret by itself.