Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution

Summary

A critical vulnerability (CVE-2026-51990) in Tencent's popular Sogou Input Method editor for Windows has been exploited by the Chinese threat actor UNC3569. The exploit chains three weaknesses to achieve one-click remote code execution, allowing the deployment of the GrayRabbit backdoor. The vulnerability was patched in version 16.3.0.3498, but the underlying outdated browser engine remains unaddressed.

Full text

A critical-severity vulnerability in Sogou Input Method has been exploited by a Chinese threat actor to deploy a backdoor, Gen Threat Labs reports. Developed by Tencent, Sogou Input Method is one of the most popular Chinese-language input method editors (IMEs) for Windows and is used by hundreds of millions of users. It is a collection of executables that communicate using a custom protocol scheme named sgbiz. When a URL is opened, the protocol handler (biz_helper.exe) parses the URL and dispatches it to the appropriate component. The critical flaw, tracked as CVE-2026-51990, chained three security weaknesses in a one-click exploit: unvalidated command-line argument injection, unrestricted URL navigation, and an outdated, un-sandboxed Chromium browser engine. According to Gen Threat Labs, the first issue existed because, during URL parsing, the protocol handler did not sanitize or validate the ‘param’ parameter, which controls the command-line arguments passed to the executable. This allowed an attacker to inject command-line arguments in the URL to declare a ‘skincenter’ page, which another function would simply copy and navigate the browser to.Advertisement. Scroll to continue reading. The next security hole goes deeper: the browser in Sogou Input Method is based on a Chromium 80 iteration released in March 2020 that is missing roughly six years of security patches, has the sandbox completely disabled, strips additional protections (including same-origin policy), and allows URLs to read other local files. The China-linked threat actor UNC3569 used this exploit chain to send crafted sgbiz URLs to unsuspecting victims. Once clicked, the exploit provided the attackers with system-level code execution. “We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GrayRabbit backdoor through a crafted link,” Gen Threat Labs says. Potentially linked to Chinese private contractor company i-SOON, UNC3569 is known for exploiting vulnerabilities in popular software to attack government, education, technology, and finance organizations globally. The GrayRabbit backdoor, which has been consistently observed across the threat actor’s intrusions since at least 2021, provides attackers with a reverse shell and can execute processes, load plugins, write data to the interactive shell, upload files to its command-and-control (C&C) server, collect system information, and terminate itself. Gen Threat Labs reported CVE-2026-51990 to Tencent on April 9. The security defect was addressed in Sogou Input Method version 16.3.0.3498, which was rolled out to all users via the automatic update mechanism. The fix added a check for URL-bearing switches in the protocol handler, but left the underlying Chromium configuration unchanged. According to Gen Threat Labs, as of September 10, the configuration and version have not been updated. Related: AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns Related: US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers Related: China, India-Linked Hackers Both Targeted Same Pakistani Police Force Related: Chinese Hackers Target Medical, Military, and AI Research in North America Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire GitLab Vulnerability Exploited One Day After DisclosureCheck Point Patches Critical VPN VulnerabilitiesSurfshark Systems Targeted by HackersPaperCut Flaws Exploited in AI-Powered AttacksCritical NetScaler Vulnerability Exploited in Attacks4.1 Million Impacted by AdaptHealth Data BreachNew ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft DefenderFortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks Latest News CISOs Race to Control AI Agents Without Destroying Their ValueTelus Warns Customers of Account BreachesThree JFrog Artifactory Flaws Exploited for Backdoor DeploymentConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like AttacksAnthropic CEO Dario Amodei Says AI Industry Needs to Give Safety Measures Time to Catch UpBlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-DaysUsers in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic SaysPhishing Research Challenges Conventional Security Awareness Testing Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveZero Networks has named Yossi Dagan as Chief Financial Officer.Manifold has appointed Joe Sullivan to its Board of Directors.Patrick McKinney has joined Turing as Chief Information Security Officer.More People On The MoveExpert Insights This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-51990
• malware — GrayRabbit

Entities