The Page That Read Your Clipboard

Internet Explorer let any web page read whatever you had copied, silently, with no permission and no prompt.

In 2026: Dead, thankfully. window.clipboardData.getData was on by default in Internet Explorer 5, so a page could poll your clipboard on a timer and post home whatever passwords or addresses you had copied. Bugtraq documented the theft around 2002. Every modern browser returns undefined for the object, as the demo shows, and the real Clipboard API now demands permission and a gesture.

Where it came from: Microsoft window.clipboardData, Internet Explorer 5, 1999. Reported as a silent-read privacy hole on Bugtraq around 2002. MDN ↗

<button onclick="peek()">What have you copied?</button>
<p id="out"></p>

<script language="JavaScript">
function peek() {
  var out = document.getElementById("out");
  // Internet Explorer 5 answered this with your actual clipboard. No prompt.
  if (window.clipboardData) {
    out.innerHTML = "Your clipboard says: " + window.clipboardData.getData("Text");
  } else {
    out.innerHTML = "window.clipboardData is undefined. The hole is closed.";
  }
}
</script>