Linux Zoom client now reads everything copied to the X11 clipboard, developer finds

What was found

Software developer Simon Tatham has documented on Mastodon that an update to Zoom’s Linux client has started proactively reading everything written to the X11 clipboard. The post, dated September 2nd, warns that anyone who keeps secrets in the clipboard — in particular anyone whose password manager copies passwords there — may need to know about it.

In his own follow-up he says the behaviour appeared in Zoom for Linux 7.1.5; the version 6.6 he had previously installed did not do it. The client is interested only in the CLIPBOARD selection, the one used with explicit copy and paste keystrokes, and ignores PRIMARY, the selection behind the traditional X11 select-and-middle-click workflow.

How he noticed

It appears to work through the XFIXES extension: whenever a new client claims ownership of the clipboard, Zoom immediately sends it a paste request. Tatham’s own tool for one-shot pasting — which claims the clipboard, answers a single paste request and quits — stopped working after an update, because Zoom asks right away.

He notes that something similar happened a year earlier with the Slack client, though Slack appeared to do it only when focus entered its window and offered a setting to switch it off; a comparable suggestion for Zoom, in the web settings, did not stop the behaviour. He adds that he has no citation to offer: it is his own research, spotted when a program received an unexpected selection request.

Reactions and limits

In the thread, users reproduced the effect with the standard xclip tool, discussed the idea of a clipboard firewall, and reported that a request to Zoom’s support, raised by one commenter’s workplace, was acknowledged as a security issue and then went quiet.

Tatham is sceptical about clean fixes. In X11 the paste protocol identifies the requesting client by a window ID rather than by application, and the window asking for the data may be an auxiliary one with a generic name — he only identified it by killing it and watching which program disappeared. Because window properties can be forged, such a defence would work against sloppy software but not against a deliberately malicious client. Wayland would prevent this behaviour, he accepts, but would break the command-line paste tools such as xclip -o that he relies on. Nothing in the discussion suggests the clipboard contents are transmitted anywhere; whether they are has not been established.