Threat actors identified as UNC3569, a group suspected of operating on behalf of China, have been observed actively exploiting a critical vulnerability in Tencent's Sogou Input Method for Windows. The flaw, tracked as CVE-2026-51990, is a one-click remote code execution (RCE) vulnerability that allows attackers to deploy the GrayRabbit backdoor.
Sogou Input Method is a widely used Windows application, particularly popular in China, designed to facilitate typing Chinese characters. It includes a custom link handler and an embedded web browser that utilizes an outdated Chromium engine.
The attack chain, as detailed by cybersecurity researchers, leverages three distinct weaknesses within the Sogou Input Method product. It begins with an unvalidated command-line argument injection vulnerability found in the `sgbiz:` URI scheme. This is followed by unrestricted URL navigation capabilities within a Chromium Embedded Framework (CEF)-based webview. The final component is the use of an outdated and unsandboxed Chromium browser engine.
When a victim clicks a specially crafted `sgbiz:` custom URI, Windows invokes Sogou's `biz_helper.exe` protocol handler. This handler then passes attacker-controlled command-line arguments to the legitimate `SGMyInput.exe` executable without proper validation. These injected arguments are designed to open Sogou's `skincenter` component and instruct its embedded Chromium webview to load a URL controlled by the attacker. Crucially, Sogou does not impose restrictions on the scheme or destination of this URL.
In the third stage of the attack, a malicious web page exploits a known vulnerability within Sogou's outdated Chromium 80 engine. Since this browser runs without a sandbox and with several important web-security protections disabled, the exploit successfully achieves code execution on the victim's system, leading to the installation of the GrayRabbit backdoor.
GrayRabbit, first described by Google researchers in 2024, is a modular malware family previously linked to UNC3569. The variant analyzed by researchers is a more advanced 64-bit version, featuring an expanded command set and RC4-encoded command-and-control (C2) configuration. Its capabilities include executing processes, establishing interactive reverse shells, uploading and downloading files, gathering system and user information, and reflectively loading plugins into the host's memory.
Researchers reported their findings to Tencent on April 9. Tencent subsequently released a fix in Sogou Input Method version 16.3.0.3498 on April 21. This patch addresses the vulnerability by validating the URL arguments accepted through the protocol handler, restricting navigation to approved domains related to Sogou and Tencent, and permitting only HTTPS. However, researchers noted that the underlying browser component remains outdated and continues to operate without a sandbox, with many web security protections still disabled.
