Tencent Patch Leaves Sogou Browser Exposed

A single click on a crafted link was enough for a China-aligned espionage group to slip a backdoor into systems running one of the most widely used Chinese input tools. According to research from Gen Digital, the attack abuses a critical remote code execution flaw in Tencent's Sogou Input Method for Windows, and while a fix has been released, the underlying browser engine at the heart of the exploit chain is still outdated and unsandboxed.

The vulnerability, tracked as CVE-2026-51990, was exploited in the wild by a threat actor known as UNC3569. Gen Threat Labs, the research arm of Gen Digital, detailed the chain in a report published this week, describing how the group chained three separate weaknesses to achieve code execution and install the GrayRabbit backdoor.

"We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link," Gen Threat Labs says.

Sogou's hidden attack surface

Sogou Input Method is a popular Windows application that lets users type Chinese characters with a standard keyboard. Beyond text entry, it includes a custom link handler and a built-in web browser powered by an outdated Chromium engine. Developed by Chinese tech giant Tencent, the software reportedly has hundreds of millions of installations in China, making it a high-value target for attackers seeking widespread access.

The attack chain begins when a victim clicks a crafted sgbiz: custom URI. This action causes Windows to invoke Sogou's biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them. The researchers found that unvalidated command-line argument injection in the sgbiz: URI is the first of three flaws exploited in the campaign.

The second weakness is an unrestricted URL navigation in a CEF-based webview. The attacker-injected arguments open Sogou's skincenter component and instruct its embedded Chromium webview to load an attacker-controlled URL. Sogou does not restrict the URL's scheme or destination, allowing the malicious page to be loaded.

Three flaws, one backdoor

The third and final stage leverages a known vulnerability in Sogou's outdated Chromium 80 engine. Because the browser runs without a sandbox and with important web-security protections disabled, the exploit achieves code execution and installs the GrayRabbit backdoor. Gen Threat Labs reports that UNC3569 chains these three weaknesses together: an unvalidated command-line argument injection, an unrestricted URL navigation, and the outdated, unsandboxed browser engine.

The malware sample analyzed by Gen Threat Labs is a more mature 64-bit variant of GrayRabbit, featuring an expanded command set and an RC4-encoded command-and-control (C2) configuration. Its capabilities include process execution, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins in the host's memory. These functions give operators significant control over compromised machines and the ability to move laterally or exfiltrate data.

"We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link."

— Gen Threat Labs

GrayRabbit is not a new malware family. In 2024, Google researchers described GrayRabbit as a modular malware family and linked it to UNC3569, a China-based threat actor operating across both the cybercrime and cyber contractor-for-hire ecosystems. The group's dual focus suggests it may rent its services to other actors or conduct espionage on behalf of state interests.

Patch limits URL, not engine

Gen Threat Labs reported their findings to Tencent on April 9, and the software vendor deployed a fix in Sogou Input Method version 16.3.0.3498, released on April 21. The patch validates the URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved domains related to Sogou and Tencent. These measures directly address the first two flaws in the chain by preventing arbitrary command-line arguments and blocking navigation to malicious sites.

However, the researchers warned that the underlying browser remains outdated and still runs without a sandbox, with many web security protections disabled. That means the third weakness—the outdated Chromium engine—persists even after the patch. Any future bypass of the URL validation or a new exploit for the browser could once again lead to code execution. The fix reduces the immediate risk but does not eliminate the attack surface.

For users, ensuring Sogou Input Method is updated to version 16.3.0.3498 or later is critical. However, because the browser engine remains unsandboxed and out of date, additional caution is warranted. Organizations that allow the software on their networks may want to consider restricting its use or isolating it from sensitive systems.

What defenders should watch

The UNC3569 campaign highlights the risks posed by custom protocol handlers and embedded browsers in widely deployed applications. Attackers are increasingly looking for these overlooked components to gain initial access. Defenders should monitor for unusual process creation involving biz_helper.exe and SGMyInput.exe, as well as outbound connections to unknown domains from Sogou processes.

• CVE-2026-51990 — critical remote code execution flaw in Tencent's Sogou Input Method for Windows
• April 9 — date Gen Threat Labs reported the vulnerability to Tencent
• April 21 — release date of Sogou Input Method version 16.3.0.3498, which contains the fix
• Chromium 80 — outdated browser engine used by Sogou's embedded webview, still unsandboxed after the patch

Network monitoring should also flag the sgbiz: URI scheme being invoked from unusual sources, such as email or web pages. Because the attack is one-click, user awareness training that emphasizes not clicking unsolicited links remains relevant, though the technical flaw bypasses many traditional defenses.

The limits of a quick fix

Tencent's patch addresses the immediate exploitation vector but leaves the underlying browser engine outdated and unsandboxed. That decision reflects a common trade-off: patching the specific flaw is faster than overhauling a component that may be deeply integrated into the application. Yet for a tool with hundreds of millions of installations, the residual risk is significant.

Gen Threat Labs' disclosure timeline shows a relatively swift response from Tencent—12 days from report to patch. That is faster than many vendors manage, but the persistence of the unsandboxed Chromium 80 engine means the product remains a potential entry point for future attacks. The researchers' warning underscores that point.

For organizations, the incident serves as a reminder that patching is not always enough. When a vendor leaves a known-weak component in place, defenders may need to compensate with network segmentation, application allowlisting, or outright removal of the software if it is not essential.

"We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link," Gen Threat Labs reiterates, emphasizing that the threat is not theoretical.

Why it matters beyond China

Sogou Input Method is primarily used in China, but its reach extends to anyone who types Chinese characters on Windows, including international businesses and individuals. The GrayRabbit backdoor's capabilities—reverse shells, file transfer, and in-memory plugin loading—make it a potent tool for espionage and data theft. The involvement of UNC3569, which operates in both cybercrime and contractor-for-hire spaces, suggests the malware could be used for a range of objectives, from intellectual property theft to persistent surveillance.

The exploit chain also illustrates a broader trend: attackers are increasingly targeting the less-scrutinized components of popular software, such as custom URI handlers and embedded browsers. These features often receive less security attention than core functions, yet they can provide a direct path to code execution. For defenders, this means expanding threat models to include every piece of software that touches the network, not just the obvious ones.

As for Sogou users, the immediate action is to update to version 16.3.0.3498 or later. But the lingering unsandboxed browser means the application remains a weak link. Until Tencent modernizes that engine, the risk will persist, and attackers like UNC3569 may continue to find ways to exploit it.

Gen Threat Labs' report provides a detailed look at how a single click can lead to a full compromise, and it underscores the importance of not just patching known flaws but addressing the underlying insecure design choices that make them exploitable in the first place.