Tencent patches Sogou Input Method flaw used to spread GrayRabbit

A vulnerability in Tencent's Sogou Input Method is being actively exploited to install a malicious tool called GrayRabbit on Windows computers. Security researchers at Gen Digital's Gen Threat Labs say the flaw, tracked as CVE-2026-51990, is a one-click remote code execution (RCE) issue, which means an attacker can run their own code on a victim's machine after a single click. The attack is carried out by a group the researchers call UNC3569.

Sogou Input Method is a widely used Windows application that lets people type Chinese characters using a standard keyboard. It includes a custom link handler and a built-in web browser based on an outdated version of Chromium, the open-source engine behind Google Chrome. Developed by Tencent, the application reportedly has hundreds of millions of installations in China, making any serious flaw in it a major security concern.

According to Gen Threat Labs, UNC3569 chains three weaknesses in the product. The first is an unvalidated command-line argument injection in the sgbiz: URI, a special link type that tells Windows to open the Sogou application. The second is unrestricted URL navigation in a CEF-based webview, a component that displays web pages inside the app. The third is an outdated, unsandboxed Chromium browser engine. A sandbox is a security barrier that isolates a program so it cannot harm the rest of the computer, and without it, an exploit can break out more easily.

The attack chain begins when a victim clicks a crafted sgbiz: link. Windows then invokes Sogou's biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them. These injected arguments open Sogou's skincenter component and instruct its embedded Chromium webview to load an attacker-controlled URL. Sogou does not restrict the URL's scheme or destination, so the attacker can point the webview to a malicious page. That page then exploits a known vulnerability in Sogou's outdated Chromium 80 engine. Because the browser runs without a sandbox and with important web-security protections disabled, the exploit achieves code execution and installs the GrayRabbit backdoor. A backdoor is a hidden way for attackers to access and control a computer.

GrayRabbit was first described by Google researchers in 2024 as a modular malware family linked to UNC3569, a China-based threat actor operating across both the cybercrime and cyber contractor-for-hire ecosystems. The sample that Gen Threat Labs analyzed is a more mature 64-bit variant with an expanded command set and an RC4-encoded command-and-control (C2) configuration. Command-and-control refers to the server that attackers use to send instructions to malware already installed on a victim's device. The malware's capabilities include process execution, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins in the host's memory. A reverse shell is a connection that lets an attacker type commands on the victim's computer from a remote machine.

Gen Threat Labs reported their findings to Tencent on April 9. The software vendor deployed a fix in Sogou Input Method version 16.3.0.3498, released on April 21. The patch validates the URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved domains related to Sogou and Tencent. This closes the immediate attack chain that UNC3569 was using. However, the researchers warned that the underlying browser remains outdated and still runs without a sandbox, with many web security protections disabled. That means users should treat this update as essential but not as a complete solution to all risks in the application.

For IT teams and website owners, this case is a reminder that any installed desktop tool with an embedded browser or custom link handler can become an entry point if not kept current. Unpatched applications, outdated browser engines, and missing sandbox protections are exactly the conditions that let a single click turn into full system compromise. For organizations that need help assessing and hardening endpoint software, AEU-I offers security-first IT and consulting. Users should update Sogou Input Method to version 16.3.0.3498 or later immediately and avoid clicking unusual sgbiz: links from untrusted sources.