This has been known for at least a decade or two already.
And a much worse attack exists: you copy e.g. shell code from the page, and instead of what you see, you paste something evil in your terminal.
back
2 comments
I don't see how the copy issue is worse. It relies on an explicit user action: selecting text in a browser window, and then copy/pasting that into a terminal. This requires three intentional steps.
Pages stealing your current middle-mouse-paste selection, however, only requires selecting text in another place, and it seems like the only way to defend against this is by not selecting text. Which, at least for me, is not really feasible.
This is another exploit that relies on ‘display: none’.