A China‑aligned threat actor has leveraged a critical remote‑code‑execution flaw in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack chains three vulnerabilities and affects hundreds of millions of users. Tencent released a patch, but the underlying browser remains unsafe.

  • CVE-2026-51990 is a one‑click RCE flaw in Sogou Input Method.
  • Attackers chain a custom URI, an unrestricted CEF webview and an old Chromium engine to install GrayRabbit.
  • Tencent issued a patch on April 21, yet the browser still runs unsandboxed.

Tencent’s Sogou Input Method, the most popular Chinese‑character input tool for Windows, has become a new vector for the GrayRabbit backdoor. Cyber‑security researchers from Gen Digital’s Threat Labs identified the flaw as a “one‑click remote code execution” (RCE) vulnerability.

Attack Chain

The exploit proceeds in three stages. First, a crafted sgbiz: URI triggers Windows to invoke biz_helper.exe, which forwards unvalidated command‑line arguments to SGMyInput.exe. Second, these arguments open Sogou’s skincenter component and direct an embedded Chromium webview to load an attacker‑controlled URL. Finally, a known vulnerability in the outdated Chromium 80 engine is leveraged to achieve code execution, installing the GrayRabbit backdoor.

Read Also:Compromised jscrambler 8.14.0 npm Release Deploys Rust Infostealer on Install

GrayRabbit Overview

GrayRabbit is a modular malware family linked to the UNC3569 threat group, active in both cyber‑crime and cyber‑contractor‑for‑hire ecosystems. Its capabilities include process execution, reverse shells, file transfer, system data collection and reflective plugin loading.

Tencent’s Patch and Remaining Risks

After Gen Digital reported the findings on April 9, Tencent released version 16.3.0.3498 on April 21. The patch validates protocol handler URL arguments, permits only HTTPS and restricts navigation to approved domains. However, the embedded browser remains unsandboxed with many web‑security protections disabled, leaving a potential vector for future attacks.

Why This Matters

BozokMedia analysis shows that a single flaw in a widely used application can expose hundreds of millions of users, highlighting the critical need for robust supply‑chain security and timely patch management across the industry.

"Using an outdated browser engine in production software is a blatant security risk, and this attack proves it," says cybersecurity expert Rajesh Kumar.
Did You Know?: Sogou Input Method is installed on more than 200 million Windows machines in China, making it one of the most widely deployed Chinese‑input tools globally.

Frequently Asked Questions

  • Q1: What is CVE‑2026‑51990?
  • A1: It is a remote‑code‑execution vulnerability targeting Sogou’s protocol handler.
  • Q2: How should users protect themselves?
  • A2: Install the latest patch from Tencent and avoid clicking unknown Sogou links.