WebView JavaScript Bridge Allows Clipboard Writes

[yuyus19]

Detection note

This issue was identified through automated LLM-based static analysis of WebView addJavascriptInterface bridges, as part of academic security research at the University of Southern Denmark (SDU) in the context of a masters level course named Engineering in Research.

The finding was manually reviewed before submission.

To aid the purposes of our research, we would kindly request acknowledgement of the reported issue as well as a final veredict from the open source community working on this repository, even if the issue is not acted on.

We are reporting in good faith and are happy to answer questions.

Summary

The SnapdropAndroid JavaScript bridge in com.fmsys.snapdrop_45 exposes two methods that can be abused by any page loaded in the WebView: copyToClipboard allows JavaScript to silently overwrite the user's clipboard (clipboard hijacking), and getTextFromUploadIntent allows JavaScript to read text the user intended to share via an Android upload intent (information disclosure). No origin validation is performed before either method executes.

Severity: Medium
Affected version(s): com.fmsys.snapdrop_45

---

Affected file(s)

• com/fmsys/snapdrop/JavaScriptInterface.java — void copyToClipboard(String)
• com/fmsys/snapdrop/JavaScriptInterface.java — String getTextFromUploadIntent()

---

Vulnerable code

@JavascriptInterface
public void copyToClipboard(final String text) {
    ClipboardUtils.copy(context, text);  // text is attacker-controlled; no origin check
}

@JavascriptInterface
public String getTextFromUploadIntent() {
    return context.getTextFromUploadIntent();  // returns user's intended share text to any caller
}

---

Proof of concept

// Clipboard hijacking: silently replaces whatever the user had copied
SnapdropAndroid.copyClipboard("phishing text");// Malicious or unexpected page


// Information disclosure: reads text the user intended to share
const sharedText = SnapdropAndroid.getTextFromUploadIntent();
// exfiltrate sharedText to attacker server

---

Impact

Clipboard Hijacking via copyToClipboard (Medium): Any JavaScript executing in the WebView can silently overwrite the system clipboard with arbitrary content. The user receives no notification. A practical attack involves replacing a copied cryptocurrency address or password with attacker-controlled data immediately before the user pastes it.

Information Disclosure via getTextFromUploadIntent (Low–Medium): When the user shares text into the app via Android's share sheet, that text is held in the upload intent and returned verbatim by getTextFromUploadIntent. Any JavaScript in the WebView can call this method and read the shared text, which may contain sensitive content (passwords, tokens, personal messages) the user did not intend to expose to the page.

---

Suggested mitigation

• For copyToClipboard: restrict calls to a known trusted origin (e.g., check the WebView's current URL before copying) or require explicit user confirmation before writing to the clipboard.
• For getTextFromUploadIntent: do not expose this as a @JavascriptInterface. Instead, push the value from Java into JavaScript via evaluateJavascript at the appropriate moment, scoped to the trusted page.
• Consider validating the WebView's current URL against a trusted allowlist in all bridge methods that read or write sensitive data.

---

pairdrop-android/app/src/main/java/com/fmsys/snapdrop/JavaScriptInterface.java

Lines 117 to 119 in c80548e

	public void copyToClipboard(final String text) {
	ClipboardUtils.copy(context, text);
	}

pairdrop-android/app/src/main/java/com/fmsys/snapdrop/JavaScriptInterface.java

Lines 131 to 134 in c80548e

	@JavascriptInterface
	public String getTextFromUploadIntent() {
	return context.getTextFromUploadIntent();
	}

[fm-sys]

Indeed both findings are correct and should ideally be guarded, however, I wouldn't consider it a real security issue right now, as only a trusted domain is displayed in the Webview without the possibility to navigate to a different domain.