Consider the following HTML file:

<div contenteditable="true" id="editable"></div>

<script>
  const editable = document.getElementById('editable');
  editable.addEventListener('paste', () => {
    navigator.clipboard.readText().then(x => console.log(x));
  });
</script>

Consider the following two scenarios in Chrome browser only:

1. I press Ctrl+V (or Cmd+V on macOS) to paste text into the textbox. In this case, I do not get any permission prompt, and the console.log works.
   Note that this appears to be contradictory to the MDN documentation which states:

   Reading requires the Permissions API clipboard-read permission be granted. Transient activation is not required.

2. If I run document.execCommand('paste', false) from the content script of a Chrome extension which has both the "clipboardRead" and the "clipboardWrite" permissions, then I do get the permission prompt. It is not clear to me why execCommand has a different behavior compared to the scenario above. The prompt is shown in this image:

My question: could anyone explain the behavior in line with relevant documentation, spec or Chromium source code?

Consider the following HTML file:

<div contenteditable="true" id="editable"></div>

<script>
  const editable = document.getElementById('editable');
  editable.addEventListener('paste', () => {
    navigator.clipboard.readText().then(x => console.log(x));
  });
</script>

Consider the following two scenarios in Chrome browser only:

1. I press Ctrl+V (or Cmd+V on macOS) to paste text into the textbox. In this case, I do not get any permission prompt, and the console.log works.
   Note that this appears to be contradictory to the MDN documentation which states:

   Reading requires the Permissions API clipboard-read permission be granted. Transient activation is not required.

2. If I run document.execCommand('paste', false) from the content script of a Chrome extension which has both the "clipboardRead" and the "clipboardWrite" permissions, then I do get the permission prompt. It is not clear to me why execCommand has a different behavior compared to the scenario above. The prompt is shown in this image:

My question: could anyone explain the behavior in line with relevant documentation, spec or Chromium source code?

• javascript
• google-chrome-extension
• clipboard

• 2 "I press Ctrl+V (or Cmd+V on macOS) to paste text into the textbox. In this case, I do not get any permission prompt" - why should you get one, when you as the user explicitly did the pasting yourself? – C3roe Commented Mar 27 at 11:45
• 2 On the paste event, you shouldn't use navigator.clipboard.readText() but rather access event.clipboardData (and .getData('text/plain') or such) – Bergi Commented Mar 27 at 15:55

1 Answer 1

First, just because something is written on MDN doesn't mean it's true and correct.

I press Ctrl+V (or Cmd+V on macOS) to paste text into the textbox.

That's a user action/gesture.

If I run document.execCommand('paste', false) from the content script of a Chrome extension which has both the "clipboardRead" and the "clipboardWrite" permissions, then I do get the permission prompt.

Clipboard copy/paste is finicky on Chromium-based browsers.

Looks like you can kind of select which approach you want to use.