Malicious Android app can hide clipboard-read warning toast
Original title: Ctrl+C, Ctrl+v, Ctrl+cve: Bypassing Android's Clipboard Read Security Measures
Google marked the moderate issue Won't Fix, so the researcher published the bypass.
A researcher says a malicious Android app can hide the system toast that warns when another app reads the clipboard by showing two of its own toasts. Google’s Android Security Team rated the issue moderate and marked it Won’t Fix, prompting public disclosure. Background clipboard access has been blocked since Android 10, and clipboard reads have shown a toast since Android 12. Copied secrets remain readable by other apps even when the keyboard preview is obscured.
Unconfirmed: The post says a moderate CVE was marked Won't Fix but does not give a CVE identifier.
- The author demonstrated the bypass with a simple Android test application.
- Android 10 disallows background clipboard access.
- From Android 12, clipboard reads display a toast to the user.
- The author also requested per-app clipboard permissions, which was not the fix path taken.
Impact: Read copied secrets without the clipboard toast
| Product | Affected |
|---|---|
| Google Android | Android 12 and later for the toast behavior |
From the original article
3 min read at toninoble.comNOTE: This blog was originally written at the end of the July 2026 but publishing was held off pending Android Security Team bug resolution. Since I have received update that this CVE of Moderate severity is now a Won't Fix I am disclosing the details publicly.
By dethmasque · toninoble.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.