Tencent Sogou Input Flaw Exploited for One-Click System-Level Code Execution

A China-linked threat actor has exploited a critical vulnerability in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack requires a victim to click a specially constructed sgbiz:// link, after which several weaknesses combine to enable system-level code execution.

Tracked as CVE-2026-51990, the flaw affects software reportedly installed by hundreds of millions of users. Tencent has distributed a fix in Sogou Input Method 16.3.0.3498, but researchers say the product’s outdated and deliberately weakened embedded browser remains unchanged.

A custom protocol turns a link into an execution path

Sogou Input Method is a Chinese-language input method editor for Windows. Its architecture includes multiple executables that communicate through the custom sgbiz protocol scheme.

The central component in this attack is biz_helper.exe. Windows invokes this protocol handler when a user opens an sgbiz:// URL, and the executable parses the link before forwarding instructions to the appropriate Sogou component.

According to the findings reported by Gen Threat Labs, biz_helper.exe did not adequately validate the URL’s param parameter. That field controls command-line arguments passed to a selected executable.

An attacker could therefore place malicious arguments inside a crafted protocol link. Once clicked, the link entered Sogou’s trusted application workflow rather than remaining ordinary browser content.

The attack did not depend on a single programming error. It chained three weaknesses:

1. Command-line argument injection: The protocol handler accepted unvalidated data from the param parameter.
2. Unrestricted navigation: Injected arguments could specify a skincenter page that another Sogou component copied and opened.
3. An unsafe embedded browser: The resulting content ran inside an obsolete, non-sandboxed Chromium implementation with several browser protections removed.

This sequence converted one user interaction into a route toward native code execution. The exact vulnerable version range has not been disclosed.

Chromium 80 magnified the protocol-handler defect

The embedded browser is based on a Chromium 80 iteration released in March 2020. It reportedly lacks approximately six years of subsequent browser security updates.

Age alone was not the only problem. The embedded implementation had its sandbox fully disabled, removing a major containment boundary intended to stop compromised web content from reaching the operating system.

Additional protections were also absent. The configuration reportedly disabled same-origin policy enforcement and allowed URLs to access other local files. These changes gave attacker-controlled content considerably more reach than it would have inside a normally configured modern browser.

The exploit chain used argument injection to make a Sogou component load attacker-selected content as a skincenter page. That content then executed inside the weakened Chromium environment, where the disabled sandbox and relaxed security restrictions enabled the final system-level compromise.

This design matters when assessing the patch. Tencent corrected the direct route involving URL-bearing switches, but the embedded browser remains a potentially dangerous attack surface. Another way to feed hostile content into that component could expose the same missing security boundaries.

No CVSS score, CVSS vector or CWE classification is available in the reported NVD information. Describing CVE-2026-51990 as critical therefore reflects the observed impact, not a disclosed NVD score.

UNC3569 used the flaw to install GrayRabbit

The exploitation was attributed to UNC3569, a China-linked threat group that may have ties to the Chinese private contractor i-SOON. That association remains a potential linkage rather than a confirmed identity.

UNC3569 has reportedly targeted organizations in government, education, technology and finance by exploiting vulnerabilities in widely deployed software. In this campaign, victims received crafted sgbiz links, and a single click was sufficient to activate the chain.

The specific channels used to deliver those links have not been disclosed. In practice, custom-protocol links can appear in content such as messages, email or documents, making installations on general-purpose Windows endpoints a broad source of exposure.

Successful exploitation installed GrayRabbit, a backdoor observed in UNC3569 intrusions since at least 2021. Its reported capabilities include:

• Opening a reverse shell;
• Starting processes on the compromised host;
• Loading additional plugins;
• Sending data to an interactive shell;
• Uploading files to command-and-control infrastructure;
• Collecting system information;
• Terminating itself.

These functions give an operator interactive control and a mechanism for extending an intrusion with additional modules. GrayRabbit’s process execution and file-transfer features could support further malware deployment or data theft, although those follow-on actions were not specifically confirmed in the reported campaign.

Gen Threat Labs reported the vulnerability to Tencent on April 9. The exact dates of the observed attacks have not been made public.

Tencent patched the link handler, not the browser architecture

Tencent addressed CVE-2026-51990 in Sogou Input Method 16.3.0.3498. The company distributed that version through the product’s automatic-update mechanism.

The update added a check for URL-bearing switches in the protocol handler, blocking the known method for injecting attacker-selected navigation into the Sogou workflow.

Organizations should not assume every endpoint received the update. Devices that were offline, have broken update services or are subject to restrictive network policies may still run an exposed build. Administrators should verify the installed version directly.

The fixed release does not resolve every condition that made the exploit effective. As of September 10, the underlying Chromium version and browser configuration reportedly remained unchanged. The embedded environment continued to lack sandboxing and other standard browser protections.

Consequently, version 16.3.0.3498 closes the reported protocol-handler path but does not eliminate the broader architectural risk. Organizations that do not require Sogou Input Method should consider removing it. Where removal is impractical, isolating affected systems or constraining custom-protocol handling can reduce exposure.

Defenders should examine Sogou-originated process chains

The immediate priority is to inventory Windows endpoints running Sogou Input Method and confirm that each installation is on 16.3.0.3498 or later. The exact earlier versions affected by CVE-2026-51990 are not known, so defenders should use the fixed build as the minimum verifiable baseline.

Security teams should also monitor for:

• Unexpected invocation of biz_helper.exe;
• Unusual or heavily encoded arguments passed to that executable;
• skincenter navigation involving untrusted or unfamiliar locations;
• Child processes launched by Sogou components;
• Local-file access originating from the embedded Sogou browser;
• Reverse-shell traffic or unexplained interactive command execution;
• Plugin loading and system-information collection associated with GrayRabbit;
• File uploads to unrecognized external infrastructure.

Organizations can block or restrict unsolicited sgbiz links where operational requirements permit. Email gateways, endpoint controls and messaging security systems should treat the scheme as an executable application trigger rather than a conventional web address.

Network egress restrictions can further limit a successful backdoor’s ability to reach command-and-control servers. No specific GrayRabbit network indicators have been disclosed, so behavior-based detection is especially relevant.

KEV status and remaining disclosure gaps

The available NVD information lists the identifier CVE-2026-51990 but does not provide an affected-version range, CVSS data or a CWE category.

It also does not establish whether the vulnerability appears in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. No KEV addition date or federal remediation deadline is known from the available information.

There is likewise insufficient information to place this incident within a series of recent Tencent vulnerabilities added to KEV. What is confirmed is active exploitation reported by security researchers, which makes remediation urgent regardless of catalog status.

The patch blocks the observed one-click chain. The unchanged browser engine, however, leaves defenders with a residual product risk that updating alone does not fully address.