In this report, we examine cloud-based pinyin keyboard apps from nine vendors (Baidu, Honor, Huawei, iFlyTek, OPPO, Samsung, Tencent, Vivo, and Xiaomi) for vulnerabilities in how the apps transmit user keystrokes. Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit. We estimate that up to one billion users could be vulnerable to having all of their keystrokes intercepted, constituting a tremendous risk to user security.
Indeed. But given it’s Google I would not be surprised if Gboard has keylogger features.
I think that would be far too large of a liability for Google for the minimal amount of data they’d get back.
Google mostly cares about metadata for their advertising business (per my understanding).