Other
Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers
Citizen Lab, University of Toronto, 2024
Read the originalRead on October 17, 2026
- What it is
- A 2024 Citizen Lab research report that tested keyboard apps from nine vendors for flaws in how they send keystrokes over the network. It also compares iOS and Android keyboard sandboxing and recommends on-device keyboards for at-risk users.
- How much weight it carries
- Independent research from a university lab, with its method described in the report. The apps tested are mainly Chinese-language keyboards, and the threat studied is a network eavesdropper, so the report does not show whether any other keyboard sends text to servers.
Facts taken from this source
- Citizen Lab recommends that Android sandbox keyboard apps by default, as iOS does, so they cannot send network traffic until the user grants access.
“Android should implement sandboxing by default for keyboard apps, similar to iOS” (Recommendations to Mobile Operating System Developers)
- Citizen Lab found critical vulnerabilities in keyboard apps from eight of the nine vendors it tested in 2024.
“Our analysis revealed critical vulnerabilities in keyboard apps from eight out of the nine vendors” (Summary)
- Citizen Lab tested keyboard apps from nine vendors in its 2024 report, including Baidu, Huawei and Tencent.
“Baidu, Honor, Huawei, iFlyTek, OPPO, Samsung, Tencent, Vivo, and Xiaomi” (Summary)
- Citizen Lab says most of the vulnerable keyboard apps it found in 2024 can be exploited by a passive network eavesdropper, who needs no action from the user.
“Most of the vulnerable apps can be exploited by an entirely passive network eavesdropper.” (Findings)
- Citizen Lab recommends that at-risk users switch from a cloud-based keyboard app to one that works entirely on-device.
“We also recommend that at-risk users consider switching from a cloud-based keyboard app to one that operates entirely on-device.” (Summary)
- Citizen Lab says third-party keyboards on iOS cannot transmit network data without the Full Access permission.
“Without this permission, third-party keyboards cannot transmit network data” (iOS sandbox discussion)