MetaMask / MetaMask/metamask-extension

[Security] How to Mitigate Security Risk of Clipboard Access When Exporting Private Keys?

Open
#28,914 0 comments 0 reactions 0 assignees View on GitHub
external-contributor
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

### What is this about?

A very serious security risk, the private key export copy can't choose to copy part of it, but only click the copy button to copy all of it, which leads to the clipboard data being accessed by other programs.
Hopefully the select partial copy function will be supported soon.

### Scenario

_No response_

### Design

_No response_

### Technical Details

_No response_

### Threat Modeling Framework

_No response_

### Acceptance Criteria

_No response_

### Stakeholder review needed before the work gets merged

- [X] Engineering (needed in most cases)
- [ ] Design
- [X] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [X] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)

### References

_No response_

Contributor guide

Open the contributing guide

Research direction

No file, test, or entry point is named. Start by locating the private-key export copy flow and reviewing how clipboard access is handled. Define the threat model and acceptance criteria with Engineering, Product, and Security; done means users can copy only a selected portion without exposing the full key to the clipboard.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.