Chinese Keyboard Apps Open 1B People to Eavesdropping

Citizen Lab identified exploitable vulnerabilities across multiple cloud-based Chinese Pinyin keyboard apps (from vendors including Baidu, Tencent, iFlytek, Samsung, Xiaomi, OPPO, Vivo, Honor) that can expose entire keystrokes to passive network eavesdroppers. The report documents apps sending keystrokes in the clear or using insufficient encryption, researcher-developed working exploits for several products, and estimates that hundreds of millions (up to ~1 billion) users may be affected, enabling large-scale surveillance and credential/financial data theft.