Clipboard Persistence Exposing Sensitive Wallet Data

### What is this about?

MetaMask Mobile allows users to paste their login password and copy their secret key and passphrase to the clipboard without adequate sanitation or warnings about persistence risks. These sensitive data elements remain in the device’s clipboard memory—potentially for years—due to vendor-specific clipboard holders (e.g., Samsung Keyboard, Gboard). An attacker with physical or malware access to the device could retrieve these details, compromising the wallet entirely.

### Scenario

**Password Pasting Without Sanitation**
Users can paste their login password into the app, which remains in the clipboard post-login.
This password persists in the clipboard history, accessible via the clipboard selector, even after a reboot.
**Unrestricted Secret Key Copying**
The app permits copying the secret key to the clipboard without limits (e.g., no expiration or single-use restriction).
**The key remains visible in the clipboard selector in plain text across reboots.**
Passphrase Copying Without Persistence Warnings
Users can copy the wallet passphrase to the clipboard without any warning about vendor clipboard persistence.
The passphrase can remain in the clipboard memory indefinitely, depending on the device’s clipboard implementation.

### Design

_No response_

### Technical Details

_No response_

### Threat Modeling Framework

**Password Persistence**
Log out of MetaMask Mobile.
Copy a test password that you have for an existing wallet to the clipboard.
Paste it into the login field and log in.
Open the clipboard selector (e.g., via Samsung Keyboard) to confirm the password remains.
Reboot the device and check the clipboard selector again—password persists.
**Secret Key Persistence**
Log in to MetaMask Mobile.
Go to Settings > Security & Privacy > Reveal Secret Recovery Phrase.
Copy the secret key to the clipboard.
Open the clipboard selector—secret key is visible in plain text.
Reboot the device and check again—secret key persists.
**Passphrase Persistence**
During wallet setup or recovery, copy the passphrase to the clipboard.
Open the clipboard selector—passphrase is visible.
Reboot the device and check again—passphrase persists in the clipboard history.

### Acceptance Criteria

_No response_

### Stakeholder review needed before the work gets merged

- [ ] Engineering (needed in most cases)
- [ ] Design
- [ ] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [ ] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)

### References

_No response_

Start by locating the clipboard handling for password pasting and secret key or passphrase copying in MetaMask Mobile. Reproduce the described flows on Samsung Keyboard or Gboard, including after reboot, and document the current behavior. Completion requires an agreed mitigation for persistence risks and verification that sensitive wallet data is no longer exposed in the clipboard, with security review.

Written by the indexing model from the issue text.