Collected research

The Curious Case of Copy & Paste - on risks of pasting arbitrary content in browsers

mibe · research.securitum.com · 2 June 2020

Copying from a malicious page and pasting into a rich-text editor can run script, because the clipboard carries HTML and the paste sanitizers in Chromium, Firefox, Safari and Edge can be mutated into producing dangerous markup. The same trick bypasses TinyMCE, CKEditor and Froala, and pasted CSS can exfiltrate the editor's contents.

Record

Researcher

mibe

Published by

research.securitum.com

Date

2 June 2020

Topic

Browser

In the archive

• Collected in the 2020 research round

Related sources

• CSS data exfiltration in Firefox via a single injection point

Tags

• sanitizer-bypass
• mutation-xss
• xss
• css-injection
• dom-clobbering
• info-leak
• filter-bypass
• javascript
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of mibe, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 August 2026.