ClipGuard

Browser extension for Chrome and Firefox that:

1. Blocks programmatic clipboard writes unless the site is on your allowlist (with an in-page Allow this site toast)
2. Optionally blocks known ClickFix / fake CAPTCHA scam hosts from loading, using public threat feeds refreshed on startup

This helps against fake CAPTCHA / “ClickFix” pages that put a malicious terminal command on your clipboard and tell you to run it.

What it blocks

Clipboard (always on)

• navigator.clipboard.writeText / write
• document.execCommand('copy' | 'cut')
• Untrusted (synthetic) copy / cut events that try to use clipboardData.setData

Native text selection + Ctrl/Cmd+C is left alone.

Scam site loading (optional, on by default)

On install/startup and every 6 hours, the extension updates a local denylist from:

• Community ClickFix domain gist (same feed used by ClickGrab)
• abuse.ch URLhaus online CSV, filtered to FakeCaptcha / ClickFix tags

Matching hosts are blocked before the page loads via declarativeNetRequest (redirected to a built-in warning page). Popular platforms (Google, GitHub, Dropbox, etc.) are excluded to reduce collateral damage. You can add your own exceptions in Settings.

Install (Chrome / Chromium)

1. Open chrome://extensions
2. Enable Developer mode
3. Click Load unpacked
4. Select this project folder (the one that contains manifest.json)

Install (Firefox)

1. Open about:debugging#/runtime/this-firefox
2. Click Load Temporary Add-on…
3. Select manifest.json from this project folder

Temporary add-ons are removed when Firefox restarts.

Usage

• Toolbar popup: allow/remove the current site for clipboard writes; toggle scam-site blocking
• Toast Allow this site: adds the current origin to the clipboard allowlist
• Settings: manage clipboard allowlist, scam-block toggle, feed status, manual refresh, and denylist exceptions

Manual test

1. Install the extension
2. Open Settings and confirm scam-site blocking shows a non-zero host count after the first update
3. Serve the clipboard test page (content scripts do not run on file:// in Chrome):

cd "Clipboard Blocker"
python3 -m http.server 8765

4. Visit http://localhost:8765/test/test-page.html
5. Confirm auto writeText is blocked and a toast appears
6. Click Allow this site, then try the buttons again — writes should succeed
7. Remove the site from the popup allowlist and confirm blocking returns
8. Select the sample text and press Ctrl/Cmd+C — native copy should still work

Project layout

manifest.json
icons/
src/
  background.js
  blocked/blocked.html   # shown when a denylisted host is opened
  content/inject.js      # MAIN-world clipboard API patches
  content/bridge.js      # allowlist sync + toast
  popup/
  options/
  shared/
    browser.js
    storage.js
    denylist.js          # feed fetch + DNR rules
test/test-page.html

Notes

• Clipboard policy is fail-closed until allowlist status is known
• Scam denylist sync needs network access; if a refresh fails, the last successful list is kept
• Feeds change quickly — blocking known hosts is an extra layer, not a complete substitute for clipboard protection
• No build step; plain Manifest V3 JavaScript