Tencent Sogou Input Method RCE Enables GrayRabbit Deployment by China‑Aligned Threat Actors

In the past week, threat actors tied to the China‑aligned espionage group UNC3569 have turned a critical flaw in Tencent’s Sogou Input Method for Windows into a one‑click weapon for deploying the GrayRabbit backdoor. The vulnerability, identified as CVE‑2026‑51990, is a remote code execution (RCE) flaw that can be triggered by simply clicking a crafted link.

How the Exploit Works

• Custom URI Handler – The attacker crafts an sgbiz: URI that Windows forwards to Sogou’s biz_helper.exe, which then passes unvalidated command‑line arguments to the legitimate SGMyInput.exe.
• Unrestricted Webview Navigation – The injected arguments open Sogou’s skincenter component and instruct its embedded Chromium webview to load an attacker‑controlled URL without any scheme or domain restrictions.
• Outdated Chromium Engine – The embedded browser runs Chromium 80, lacks sandboxing, and has key web‑security protections disabled, allowing a known exploit to execute arbitrary code and install GrayRabbit.

"We observed this vulnerability actively exploited in the wild by UNC3569 to deploy the GRAYRABBIT backdoor through a crafted link," Gen Threat Labs notes.

GrayRabbit Backdoor

The malware that lands on compromised machines is a mature 64‑bit variant with an expanded command set. It can execute processes, open reverse shells, upload/download files, harvest system and user data, and load plugins reflectively into memory. Its command‑and‑control configuration is RC4‑encoded, adding a layer of obfuscation.

Vendor Response

Gen Threat Labs reported the findings to Tencent on April 9. The vendor released version 16.3.0.3498 on April 21, which:

• Validates URL arguments accepted via the protocol handler.
• Restricts navigation to HTTPS and approved Sogou/Tencent domains.
• Adds basic input validation to the URI handler.

However, the patch does not address the core issue: the embedded Chromium engine remains outdated, unsandboxed, and missing critical web‑security features.

Mitigation Recommendations

• Update Sogou Input Method to the latest patched version immediately.
• Disable or uninstall the application if it is not essential.
• Apply system‑wide application whitelisting to block execution of unknown binaries.
• Maintain an up‑to‑date antivirus/EDR solution that can detect GrayRabbit signatures.
• Monitor for abnormal outbound traffic to known GrayRabbit C2 domains.

While the patch mitigates the immediate exploitation vector, organizations should treat Sogou Input Method as a high‑risk application until the underlying browser component is fully updated or replaced.