Flaws in Chinese keyboard apps leave 750 million users open to snooping, researchers claim

Citizen Lab research found that many popular Chinese Pinyin input method editor (IME) apps—from vendors including Baidu, Samsung, Xiaomi, OPPO, Honor, iFlytek, Tencent and Vivo—use cloud processing or weak/compromised cryptography that can expose users' keystrokes to passive and active eavesdroppers. The flaws and demonstrated exploits affect widely deployed preinstalled keyboard apps representing over 95% market share in China, putting an estimated ~780 million users at risk; patching and update gaps mean the vulnerabilities are likely to persist.