Pop ups still occur, even on legitimate sites. Tripadvisor creates a pop-under when you click on a search result, for instance.<p>Basically, the user will click something at some point, the page can then unexpectedly put malicious stuff into the clipboard. No amount of protecting will stop this.