Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Virtual Keyboard

CRITICAL RISKRemoved from Chrome Web Store

Virtual Keyboard

ID: pflmllfnnabikmfkkaddkoolinlfninn

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.12.8

Size

0.06 MB

Rating

3.1/5

Reviews

758

Users

219,415

Type

Extension

Updated

Dec 29, 2023

Publisher Contextual Analysis

Trusted

Author: https://xontab.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

219,415

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Fullscreen on-screen virtual keyboard for touch screen devices

Suggest a Feature: https://apps.xontab.com/Suggest/VirtualKeyboard/ Extension Details Page: http://apps.xontab.com/VirtualKeyboard/ Virtual Keyboard will popup automatically when the user clicks on an input field such as textboxes and textareas. Futhermore, the keyboard will disappear automatically when no longer needed. This extension is ideal for touch screen devices. This keyboard works like an iOS/Android/Windows 8 touch virtual keyboard. Version History: 1.12 - Optimisations and minor fixes 1.11.1 - Added Swedish keyboard layout 1.10.9 - MAXLENGTH HTML5 forms feature is now supported 1.10.5 - Added Norwegian keyboard layout 1.10.3 - Added Hungarian keyboard layout 1.10.0 - Added Korean and German keyboard layouts 1.9.15 - Added Tamil 99 keyboard layout 1.9.13 - Added Polish and Spanish keyboard layouts 1.9.10 - Added Slovenian keyboard layout 1.9.6 - Minor fixes, Added "Auto Clicking via Mouse Hover" feature 1.9.0 - Added Hardware acceleration BETA (for faster animations) This option needs to be enabled from the options page Added Zoom level 1.8.8 - Bug fix (thanks to Alex) 1.8.3 - Improved touch events support. 1.8.0 - Bug fixes and Improvements thanks to Stuart Wright. Improved enter button, memory usage, keyboard events triggering, small keyboard enhancements and much much more. 1.7.2 - Added a smaller keyboard 1.7.1 - Added AZERTY keyboard layout (Beta) 1.7 - Added basic iframe support (Note: Cross-domain and wysiwyg are not supported due to security restrictions in Google Chrome) 1.6.1 - Added on-demand mode 1.6 - Added toggle button 1.5.13 - Added underscore button 1.5.4 - Added support to Touch events 1.5.3 - Bug fixes; Migrated to manifest version 2 1.5.0 - Added Russian Keyboard Layout 1.4.7 - Added URL Bar (needs to be enabled from options page) 1.4.6 - Improved UI for various screen sizes 1.4.5 - Fixed Return key in Textareas. Added some features requested on Suggestion page 1.4 - Added number row, Added support to email and number fields 1.0 - Initial Version Visit http://xontab.com/Apps for more FREE Chrome Extensions

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-25.35%(-74,520 users)

Compared to 4 months ago

1 version released in this period

Rating Count

Total: 755 ratings

Average Rating

Current: 3.13 / 5.0-0.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.12.8 Code review	6

Extension Version	Code Review Findings
1.12.8	6

Files with findings

5 distinct paths — top paths by unique finding count:

manifest.json2
keyboard.html1
options/script.js1
script.js1
toggle.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	toggle.js (line 20)	The click handler for 'goToUrl' calls eval(callback) where callback is never defined anywhere in toggle.js or toggle.html — it is not a parameter, not a local variable, and not imported. This references an undeclared …	1.12.8
2	Code Injection	high	manifest.json (line 45)	The manifest explicitly relaxes the Content Security Policy to allow 'unsafe-eval', enabling eval(), new Function(), setTimeout(string), and setInterval(string) execution throughout the extension context. This is a de…	1.12.8
3	Code Injection	high	script.js (line 363)	The setting_load helper evaluates the callback argument as a raw JavaScript expression via eval() before calling it. Although internally the callers pass function-name strings, the eval() means any string is accepted:…	1.12.8
4	Unauthorized Data Collection	high	manifest.json (line 46)	The content script is injected into every URL (including https:// banking, healthcare, and authentication pages) and into every iframe on those pages (all_frames: true). This gives script.js — which contains multiple …	1.12.8
5	Code Injection	medium	options/script.js (line 110)	The callFunc utility, called from change handlers for all settings UI elements, evaluates the callback string with eval(). The callback value originates from _changed HTML attributes in the options page DOM. Since opt…	1.12.8
6	Phishing	medium	keyboard.html (line 11)	The built-in URL bar constructs a navigation target by prepending a hardcoded 'http://' to user input, forcing all navigation to plain HTTP regardless of what the user types. This silently downgrades HTTPS destination…	1.12.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
apps.xontab.com	/Suggest/VirtualKeyboard	http://apps.xontab.com/Suggest/VirtualKeyboard?from=VKO
apps.xontab.com	-	https://apps.xontab.com/?from=VKO
xontab.com	-	http://xontab.com?from=VKO
xontab.com	/advert.html	http://xontab.com/advert.html
xontab.com	/res/images/logo/header.png	https://xontab.com/res/images/logo/header.png

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Please change your icon for "pinning" the extension to Chrome. When using a dark/black theme in Chrome it makes the icon invisible. It needs some white highlights or something. My other issue is when using this on YouTube the "On Demand" function rarely works. You have to put it on "Always On", which means when not using YouTube I have to manually turn it back to "On Demand". Thanks.

Penumbra1979·16 Dec 2023

dose not work . do not waste your time and do not download anything from this store

Iosono Africano·30 Nov 2023

How to you add a language and then change it it doesn't have that option?

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Virtual Keyboard

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating