clipboardWrite

Use this for any extension that needs to place data on the user's clipboard.

Examples:

• A "copy link" button in a custom UI.
• An extension that generates a password and copies it for the user.
• A tool that copies a formatted citation to the clipboard.

{
  "name": "My Clipboard Extension",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "clipboardWrite"
  ]
}

Note: In Manifest V3, calls to navigator.clipboard.writeText() made directly inside a user-gesture handler (e.g., an onclick listener in a popup) succeed without this permission. Declare clipboardWrite when the write happens without a user activation — e.g., from an alarm handler, message listener, or other service-worker-driven flow that bridges through an offscreen document.

Why is it risky?

This permission allows an extension to change the contents of your clipboard (what you paste with Ctrl+V or Cmd+V). This can be used for a sneaky attack called "clipboard hijacking."

For example, imagine you copy a friend's cryptocurrency wallet address to send them money. A malicious extension could instantly replace that address in your clipboard with a hacker's address. When you paste it, you would unknowingly send your money to the wrong person. Be cautious with extensions that want to write to your clipboard without you telling them to.

This example copies text to the clipboard from a service worker when the user clicks a context menu item. It does not require any permissions in the manifest.

// background.js

// Requires the "contextMenus" permission
chrome.runtime.onInstalled.addListener(() => {
  chrome.contextMenus.create({
    id: "copy-page-url",
    title: "Copy Page URL",
    contexts: ["page"]
  });
});

chrome.contextMenus.onClicked.addListener((info, tab) => {
  if (info.menuItemId === "copy-page-url" && tab.url) {
    copyTextToClipboard(tab.url);
  }
});

async function copyTextToClipboard(text) {
  try {
    await navigator.clipboard.writeText(text);
    console.log('URL copied to clipboard!');
  } catch (err) {
    console.error('Failed to copy text: ', err);
  }
}