Websites should not be able to overwrite the clipboard unless the action is user-initiated, from the blog post: <i>The execCommand(&quot;cut&quot;&#x2F;&quot;copy&quot;) API is only available during a user-triggered callback, such as a click. If you try to call it at a different time, execCommand will return false, meaning that the command failed to execute.</i>