Linux Zoom client proactively reading everything written to X11 clipboard

Your typed passwords and sensitive information may be exposed to Zoom. It's possible that Zoom's servers are receiving your clipboard data, even if you aren't actively sharing it.

The Linux version of the Zoom client has been found to be actively monitoring and reading all data written to the X11 clipboard. This behavior was discovered by a security researcher who observed the Zoom application continuously accessing clipboard contents, regardless of whether the user was actively using Zoom features that might require clipboard access, such as screen sharing or file transfers. The X11 windowing system, commonly used on Linux desktops, handles the clipboard as a global buffer accessible by any running application. The researcher's findings indicate that Zoom's client is not selectively accessing clipboard data but rather performing a broad, ongoing scan.

This discovery raises significant privacy concerns for Linux users of Zoom, highlighting a potential vulnerability where sensitive information, including passwords, financial details, and private communications, could be logged or transmitted without explicit user consent. The broad access suggests a design choice that prioritizes data capture over user privacy, a risky approach in an era of heightened cybersecurity awareness. It also points to a potential lack of robust security auditing within Zoom's development process for its Linux client.

The implications extend to how applications interact with system-level resources like the X11 clipboard. This incident may prompt stricter security practices and development guidelines for applications on Linux, potentially leading to new security tools or stricter sandboxing mechanisms for desktop applications. Users are advised to be cautious about running untrusted applications or to consider alternatives that demonstrate better respect for user privacy and data security.