Hackers exploit Tencent app flaw to deploy GrayRabbit malware

UNC3569, a China-aligned threat actor, is actively exploiting CVE-2026-51990, a critical one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows. The attack chains multiple weaknesses — including a vulnerable protocol handler, webview component, and an outdated Chromium engine — to deploy the GrayRabbit backdoor without meaningful user interaction. This highlights the compounding risk of shipping software with embedded, outdated third-party engines that expand the attack surface far beyond what organizations typically track. The incident underscores that widely deployed productivity and input tools are increasingly targeted as soft entry points into enterprise environments, and that delayed patching of non-obvious software creates critical blind spots in vulnerability programs.