Android clipboard read alerts can be hidden by custom toast notifications, researcher finds

A researcher has publicly disclosed a method that can obscure Android's clipboard read alert by rapidly triggering two developer-created toast notifications. The disclosure came after the researcher learned that a related CVE of Moderate severity had been marked Won't Fix by the Android Security Team. The issue matters because copied credentials, such as a password shared through Slack, may be readable by another application without the user noticing the usual alert.

How the bypass works

Using a simple Android test application, the researcher was able to bypass the clipboard read security measure. The test rapidly triggered two developer-created toast notifications that displayed instead of the message alerting the user that clipboard contents had been read. The researcher had recently installed Android Studio and forked the Android Meshtastic app repository while trying to fix a notification timestamp bug, which left Android development tools available and prompted the idea. The notification timestamp bug could not be reproduced.

Existing Android clipboard protections

Google's Secure Clipboard Handling documentation places responsibility for safely copying sensitive content on application developers. Android supports the ClipDescription.EXTRA_IS_SENSITIVE or android.content.extra.IS_SENSITIVE flag, which allows developers to visually obfuscate clipboard content previews in keyboard interfaces. Without one of these flags, attackers could exfiltrate sensitive data through shoulder surfing or through malicious applications that take screenshots or record videos while running in the background. Google's Authenticator app uses this functionality when codes are copied, so a nearby person cannot see the secret when the keyboard opens, although the value remains readable to other applications. Since Android 10, background clipboard access has been disallowed, and applications that capture the screen require explicit permission each time unless the recording app is signed with the same key as the Android operating system. From Android 12 onward, at API level 31, an application that accesses clipboard data and pastes it triggers a toast message shown to the user.

Potential misuse and requested controls

The researcher noted that nefarious application developers could use open source intelligence to determine an associated account name, or sell a copied secret by itself. The researcher had previously opened a feature request in Google's IssueTracker asking for clipboard access control with per-app permissions, similar to Location or Notification settings. That request followed the view that an automatically dismissed and easy to miss toast notification is not sufficient for a potentially sensitive operation. The blog was originally written at the end of July 2026, but publication was held off pending Android Security Team bug resolution.

Sources: toninoble.com