Dan Goodin for Ars Technica:
As already alluded, the threat stems from the use of the Android clipboard, which acts as a temporary cache for text that is being copied and pasted, either within the same app or from one app to another. Android has no official programming interface that secures the clipboard. By design, its contents are available to any app installed on the phone, from the highest privileged banking app to one with no privileges at all.
Android wins.
Uh… How is that different from how the clipboard works on iOS?
Not really that different. As the article points out iOS is as vulnerable. The problems lie in what else you have on your phone, and Android is targeted as much as Windows desktops these days. Neither are in the neighborhood of Java but they are still quite a lot.
Like all things in security you have to look at the overall ecosystem. Safari on iOS supports password management through keychain which handles most basic people’s needs. Since I have a lot of passwords (and other detritus) to manage I use 1Password which supports Safari on iOS through extensions directly and increasingly I’m seeing more apps which support it natively through their secure API.
Last time I looked at Chrome on Android it didn’t support extensions so you must use the clipboard. Also the Android ecosystem has no front runner for password management so you don’t see 1Password (or similar) integrated into apps.
The main issue is not so much the vulnerability of the clipboard in as much as what malware is present to take advantage of it, and disclose it to an evildoer.