A critical flaw in Tencent’s Sogou Input Method allowed Chinese threat actors to execute arbitrary code with a single click. The CVE‑2026‑51990 chain of vulnerabilities enabled the deployment of the GrayRabbit backdoor via crafted URLs.

  • The Sogou IME CVE‑2026‑51990 allows one-click remote code execution.
  • Chinese threat group UNC3569 used it to deploy the GrayRabbit backdoor.
  • Despite a patch, the underlying Chromium configuration remains a risk.

Sogou Input Method, developed by Tencent, is one of the most widely used Chinese-language input method editors (IME) on Windows, serving hundreds of millions of users. It communicates through a custom protocol named sgbiz, with the biz_helper.exe handler parsing URLs and dispatching commands.

The vulnerability, tracked as CVE‑2026‑51990, chains three weaknesses: unchecked command‑line argument injection via the param parameter, unrestricted URL navigation, and an outdated, unsandboxed Chromium browser engine. The first flaw allows attackers to inject a ‘skincenter’ page, while the second exploits a Chromium 80 engine from March 2020 that lacks six years of security patches and has sandboxing disabled.

Using this exploit chain, the China‑linked threat actor UNC3569 sent crafted sgbiz URLs to unsuspecting victims. A single click granted attackers system‑level code execution and the installation of the GrayRabbit backdoor, which provides a reverse shell, file upload, system information gathering, and self‑termination capabilities.

Gen Threat Labs reported the issue to Tencent on April 9. The fix in version 16.3.0.3498 added URL‑switch validation but left the Chromium configuration unchanged. As of September 10, the software still carries the same underlying risks.

Why This Matters

BozokMedia analysis shows that Sogou IME’s widespread use and deep integration into the Windows ecosystem make it a high-value target for nation‑state actors. This case underscores the growing threat of one‑click exploits that enable remote code execution on a global scale.

"The incident highlights how outdated software configurations and unsandboxed browsers can pose significant security risks."
Did You Know? The 2020 Chromium-based Sogou IME version 80 lacks security patches released since 2014.

Frequently Asked Questions

Q1: Does the latest Sogou IME version fully resolve the vulnerability?
A1: The patch adds URL validation, but the underlying Chromium configuration remains vulnerable.

Q2: Are other platforms or operating systems affected by CVE‑2026‑51990?
A2: The flaw is specific to the Windows version of Sogou IME.