@MrIgareshka
Thanks for the suggestion. Funny thing is the offending domain is chrome://flags, which can’t be added into the #unsafe-treat-insecure-origin-as-secure list (i.e. list entry doesn’t persist after restarting).
By default my browser allows all sites to ask to see my clipboard, and I never added any site to denylist. I tried again here to add the domain into the allowlist, but errored out for invalidity.
Edit: I’ll update as I try other sites