The async Clipboard API in Source/WebCore/Modules/async-clipboard/Clipboard.cpp gated clipboard access on UserGestureIndicator::processingUserGesture() rather than on the relevant global object’s transient activation. The W3C Clipboard API spec requires the calling document’s global object to have transient activation to read or write the clipboard. UserGestureIndicator::processingUserGesture() reports whether a user gesture is being processed anywhere in the current call stack, and crucially a user gesture / gesture token can propagate across frames via mechanisms like postMessage, whereas transient activation is deliberately NOT propagated to cross-origin iframes. The violated invariant is that clipboard access must be authorized by the transient activation of the accessing frame’s own global object, not by any in-flight user gesture that may have originated in a different (top-level, cross-origin) context. Because shouldProceedWithClipboardWrite returned true for the RequiresUserGesture policy whenever processingUserGesture() was true, a cross-origin iframe could have a top-level page relay a user click to it via postMessage and, while that gesture was still being processed, invoke navigator.clipboard.write/writeText and pass the gesture check even though the iframe itself never received transient activation. The read paths (readText and read) had a separate gap: they only checked that a document existed, not that it had transient activation, so they too could be invoked without proper activation.

The fix introduces frameHasTransientActivation(frame) and documentHasTransientActivation(document) helpers that query window->hasTransientActivation(), replaces the processingUserGesture() check in shouldProceedWithClipboardWrite with frameHasTransientActivation, and adds !documentHasTransientActivation(*document) rejection guards (throwing NotAllowedError) to both readText and read. It also drops the now-unused UserGestureIndicator include and adds LocalDOMWindow. This restores the invariant by keying every clipboard operation to the accessing frame’s own transient activation, which cross-origin frames cannot borrow.

This is a security-policy / logic bug, not a memory-safety issue: the primitive is unauthorized clipboard read (information disclosure of whatever sensitive data the user copied) and clipboard write from a cross-origin iframe that only borrowed a top-level gesture. There is no memory corruption and no path to code execution from this bug alone; the impact ceiling is confidentiality/integrity of clipboard contents. It operates within the WebContent process and requires one genuine user interaction on the top-level page plus attacker-controlled iframe content to exploit.