https://www.ghacks.net/2022/01/04/google-chrome-97-introduces-controversial-keyboard-api/
The new version of Google Chrome launches with a controversial Keyboard MAP API. The API could not be used previously by certain web experiences because it could not be used inside iframes. Apps such as Microsoft’s Office web applications could not make use of the API to detect key presses on keyboard layouts. Keyboard layouts differ depending on the region or language. The change makes the functionality available to web applications that are inside iframes…
Apple published a response on GitHub, stating:
As I’ve noted in person a while ago, the Keyboard Map API as proposed exposes a high entropy fingerprinting surface. This is not acceptable from privacy perspective. As a result, the WebKit team at Apple is not interested in implementing this feature as currently proposed / spec’ed.
Brave Software, maker of the Brave Browser, had this to say:
Brave inherits from Chrome implementation of Keyboard API which does not provide any functionality to the user (only Chrome and Opera support it and, to my knowledge, no site actually uses it). However, the API might be used for fingerprinting.
WICG Keyboard Map Draft mentions that the API can be used for fingerprinting of:
Users who use uncommon ASCII layouts (like Dvorak or Colemak)
Users who use an ASCII layout that doesn’t match the default for the region that they are in. For example, a user in the US with an active UK or French layout…Mozilla finally added the Keyboard Map API to the list of harmful APIs that it won’t implement in the Firefox web browser.