Mobile Browsers Read Clipboard Data and Expose Plaintext Passwords, CCTV Report Shows

According to a CCTV report, the implementation of China’s Personal Information Protection Law now provides legal backing for protecting personal data and preventing users’ privacy from being exposed online.

Nevertheless, many users still feel that mobile apps are monitoring them: after viewing a product or entering a keyword, they quickly receive related ads or notifications from the app.

Security engineers from a network‑security firm used detection tools to test two mobile browsers for data‑collection behavior. They copied a simulated bank account number and password, and the tools discovered that the browsers accessed the copied credentials even without being actively used.

The engineers reported that the apps read the bank account and password in plaintext, without any encryption, and transferred the data out.

Further testing showed that the browsers also captured phone numbers, SMS content, and browsing history of e‑commerce sites, even when the browsers were running in the background or after the process was closed.

Network‑security engineers concluded that some browser apps and embedded third‑party SDKs silently collect clipboard information in a background or silent state, potentially leading to serious personal data leaks and enabling targeted advertising.