I couldn't get this working in librewolf, maybe the hardening it uses prevents this. It works like a hot damn in tor browser though, which is supposed to be fairly locked down. Don't forget to turn off javascript before you leave home, kids. In chrome based browsers it rewrites the X11 paste buffer if you select anything on the page that's running the script, which is effectively the old fashioned clipboard rewrite attack. This is a nice find, I like it.<p>To those wondering who would paste and execute without a second look, there are ways to hide text. You can also paste control characters, so if you pasted into vim the command would get executed without any visible feedback. Same could be true for emacs, someone who knows it better could pipe in.<p>Any time you run potentially malicious code (like clicking on a random link when you have javascript enabled) on the same computer as data you care about, you're taking a risk. Sandboxing is a compromise, but one that's usually worthwhile.