Tencent Patches Critical Sogou Input Method RCE Flaw Exploited by UNC3569

A critical remote code execution vulnerability in Tencent’s Sogou Input Method for Windows is being actively exploited in targeted cyber espionage campaigns. The zero-day flaw, tracked as CVE-2026-51990, allows remote attackers to compromise vulnerable systems through a single user click on a malicious link, dropping the GrayRabbit backdoor. Cybersecurity researchers at Gen Digital identified the active exploitation and attributed the activity to UNC3569, a China-aligned threat group known to bridge state-sponsored intelligence gathering and contractor-for-hire cybercrime.

Sogou Input Method is an essential software utility across Chinese-speaking regions, used by hundreds of millions of users to translate standard keyboard inputs into Chinese characters. To support custom UI themes, web extensions, and embedded services, the application installs custom Windows URI protocol handlers and embeds an internal web browser. The flaw lies in how these components interact when handling external links, creating an unrestricted bridge from an untrusted browser link directly into local code execution.

The CVE-2026-51990 Exploitation Chain

The attack relies on chaining three distinct software weaknesses within the Sogou Input Method client to execute arbitrary code without prompting typical security alerts:

1. Custom Protocol Argument Injection: Windows applications can register custom protocol handlers (such as sgbiz:) in the system registry to launch application features directly from web browsers or documents. When a victim clicks a crafted sgbiz: link, Windows passes the URI string to Sogou’s biz_helper.exe handler. The process fails to sanitize input, allowing attacker-controlled command-line arguments to be injected directly into the execution call for SGMyInput.exe.
2. Arbitrary Navigation in Embedded Webview: Injected command-line arguments force SGMyInput.exe to open Sogou’s skincenter component and instruct its internal browser view to navigate to an external, attacker-controlled URL. The client application performs no domain validation, scheme filtering, or origin checks before loading the remote web page.
3. Unsandboxed Legacy Browser Exploit: To render web content, Sogou relies on an embedded build of Chromium 80—an engine version released years ago. Worse, Tencent compiled this embedded renderer with critical Chromium sandbox controls and web-security protections explicitly turned off. When the custom URI opens the attacker’s page, malicious scripts exploit known vulnerabilities in the legacy Chromium 80 engine, instantly achieving unprivileged remote code execution on the host machine.

Because the host application runs without sandbox isolation, code execution within the webview immediately translates to full user-level privileges on the underlying Windows system, bypassing browser security boundaries completely.

UNC3569 and the GrayRabbit Backdoor

The threat group behind these attacks, UNC3569, operates within the broader Chinese offensive cyber ecosystem. Historically characterized as a flexible threat actor that executes both targeted espionage missions and mercenary operations, UNC3569 frequently targets regional software utilities and localized software supply chains to gain initial access to high-value networks.

Upon successfully exploiting CVE-2026-51990, the group deploys GrayRabbit, a modular backdoor first detailed by security researchers in 2024. The sample analyzed in this campaign represents a matured 64-bit build equipped with an upgraded feature set and RC4-encrypted command-and-control (C2) configuration files.

GrayRabbit provides operators with full administrative control over the compromised endpoint. Its core capabilities include:

• Spawning interactive reverse shells and executing arbitrary system commands.
• Performing bidirectional file transfers (uploading additional tooling and exfiltrating data).
• Conducting detailed host reconnaissance, gathering local user accounts, hardware profiles, and active process lists.
• Reflectively loading dynamic link libraries (DLLs) directly into host memory to execute secondary payloads without writing files to disk, minimizing forensic artifacts.

Architectural Risks and Blast Radius

The blast radius for this vulnerability primarily covers enterprise networks operating in China or organizations with remote personnel, linguists, and regional offices in the Asia-Pacific region. Input Method Editors (IMEs) are ubiquitous on Chinese-language enterprise desktops, yet they are frequently overlooked by corporate patch management programs and third-party risk auditing tools.

From an architectural standpoint, CVE-2026-51990 highlights a recurring vulnerability class in desktop software: bundling un-sandboxed, obsolete browser engines to render rich UI components. While Tencent responded to Gen Digital’s disclosure on April 9 by releasing a patch on April 21 (version 16.3.0.3498), the underlying fix addresses argument validation rather than the root architectural risk.

Version 16.3.0.3498 resolves the immediate exploit vector by validating protocol handler inputs, enforcing HTTPS connections, and strictly limiting navigation to approved Tencent and Sogou web domains. However, the application continues to run the outdated Chromium 80 rendering engine without proper sandbox isolation. Should threat actors discover an alternative parameter injection vector or local file inclusion path in the application, the underlying browser engine remains highly vulnerable to memory corruption exploits.

Remediation and Mitigation Guidelines

Organizations supporting Chinese-language desktop environments should immediately assess their software inventory for vulnerable installations of Sogou Input Method for Windows.

• Apply Vendor Updates: Deploy Sogou Input Method version 16.3.0.3498 or later across all managed endpoints. Ensure auto-update mechanisms are functioning for non-domain-joined devices.
• Inspect Protocol Handler Executions: Configure Endpoint Detection and Response (EDR) rules to monitor execution arguments for biz_helper.exe and child processes spawned by SGMyInput.exe. Flag any command-line parameters containing external domain strings or unapproved HTTP/HTTPS URLs.
• Restrict Custom URIs: Where Sogou IME is required purely for text translation rather than online theme customization, consider blocking or unregistering the sgbiz: custom URI handler within the Windows Registry (HKEY_CLASSES_ROOT\sgbiz) via Group Policy or management scripts.
• Network Egress Filtering: Monitor network traffic originating from IME binaries. Input method software generally does not require arbitrary outbound TCP connections to external C2 infrastructure; enforce application-aware firewall policies restricting runtime outbound traffic to approved enterprise gateways.