Zoom Linux Client Found Reading Clipboard Without Authorization

In September 2026, the latest version of Zoom's desktop client for Linux was found to carry a privacy overreach risk. Open-source security researchers and Linux users testing the client found that while it runs in the background, it continuously polls and reads the contents of the system clipboard without user authorization or an active paste interaction.

The behavior was first discovered by open-source community users while investigating system resource scheduling and interface call logs. Technical evidence shows that under the X11 display server environment, and under some Wayland compatibility layers that do not impose strict sandbox restrictions on clipboard isolation, the Zoom main process triggers system clipboard API calls at high frequency even when minimized, resident in the background, or idle during a meeting.

Text data that users copy, such as account passwords, two-factor authentication (2FA) recovery keys, private communications, and confidential business code, is captured by the Zoom client in the background within milliseconds of entering the system clipboard. The clipboard is a temporary staging area used for information exchange in desktop operating systems.

As of September 13, 2026, Zoom had not given a public response on the cause of the issue, the specific range of affected versions, or a schedule for rolling out an official fix.