Security researchers discovered a critical privacy vulnerability in the latest Linux version of the Zoom desktop client. The application continuously monitors and reads the system clipboard in the background without user consent or interaction. This behavior occurs even when the software is minimized, idle, or running in the background.
The issue primarily affects systems using the X11 display server and some Wayland compatibility layers lacking strict isolation. The client frequently triggers clipboard API calls, potentially exposing sensitive data such as passwords, 2FA recovery keys, and private communications copied from other applications like browsers or password managers.
Analysts suggest the flaw may stem from poor engineering, such as inefficient polling logic intended for features like meeting link detection or text formatting. Regardless of the intent, the unauthorized access to clipboard data violates standard privacy principles and poses significant security risks to enterprise and individual users.
Experts recommend that Linux users avoid handling sensitive information while Zoom is active until a patch is released. Suggested workarounds include using pure Wayland environments, implementing sandboxing tools like Firejail to restrict clipboard access, or switching to the web-based version of the service.
As of now, Zoom has not issued an official statement regarding the cause of the vulnerability, the specific versions affected, or a timeline for a security update to address the unauthorized data access.
