Hackers are weaponizing a newly disclosed vulnerability in Tencent's Sogou Input Method for Windows, turning a popular Chinese keyboard app into a delivery vector for the GrayRabbit backdoor. The flaw, catalogued as CVE-2026-51990, enables a single click to execute arbitrary code, and threat actors linked to the China-aligned UNC3569 group have been observed exploiting it in the wild. This Tencent Sogou GrayRabbit chain illustrates how a seemingly benign UI component can become a high-value target for espionage and financial crime.

Attack Chain Overview

  • Step 1 – Malicious URI: Victims click a crafted sgbiz: link. Windows passes the link to biz_helper.exe, which forwards attacker-controlled arguments to SGMyInput.exe without validation.
  • Step 2 – Webview Hijack: The injected arguments launch the skincenter component, forcing the built-in Chromium webview to load an attacker-controlled URL. No scheme or domain filtering is applied.
  • Step 3 – Exploit Outdated Chromium: The malicious page exploits a known vulnerability in Chromium 80, which runs without a sandbox and with key mitigations disabled. Successful exploitation writes the GrayRabbit payload to disk and registers it as a service.

Evidence from Gen Digital’s Threat Labs shows the payload is a 64-bit variant with RC4-encoded C2 configuration, capable of process execution, file transfer, system profiling, and reflective DLL loading. The group’s tooling mirrors earlier 2024 findings that linked GrayRabbit to UNC3569, a hybrid criminal-state actor operating across cybercrime markets and contractor-for-hire services.

Patch Rollout and Residual Risk

Tencent issued version 16.3.0.3498 of Sogou Input Method on April 21, 2026. The update introduces:

  • Validation of URL arguments passed through the protocol handler.
  • Enforcement of HTTPS-only schemes.
  • Whitelisting of navigation domains to those owned by Sogou or Tencent.

However, the underlying Chromium engine remains at version 80 and continues to run without sandbox isolation. Analysts warn that while the immediate RCE vector is closed, the embedded browser still presents a high-risk attack surface for future zero-day exploits. Enterprises should treat the patch as a partial mitigation, not a full remediation.

Market and Operational Impact

  • Enterprise exposure: With “hundreds of millions” of installations in China and a growing user base among diaspora communities, the flaw threatens a massive attack surface. Companies that rely on Sogou for internal communications or employee devices must inventory installations and enforce the latest version.
  • Supply-chain considerations: The incident underscores the danger of third-party UI components that bundle outdated browsers. Security teams should audit all software that includes embedded webviews, especially those built on Chromium Electron or CEF frameworks.
  • Crypto-related risk: Threat actors could leverage GrayRabbit to harvest private keys stored in local wallets or intercept API calls to exchanges. Users checking live crypto prices should ensure their endpoints are patched and consider hardware wallets to isolate private keys.

Immediate Defensive Actions

  • Block sgbiz: URIs at the network perimeter using web-filtering appliances.
  • Deploy endpoint detection that flags execution of biz_helper.exe with unusual command-line parameters.
  • Monitor outbound traffic for connections to known GrayRabbit C2 domains; the backdoor uses RC4-encoded payloads over HTTP(S).
  • Upgrade or replace the Sogou Input Method with a version that ships a sandboxed, up-to-date browser engine, or disable the built-in webview entirely via Group Policy.

What to Watch Next

  • Follow-up exploits: Researchers suspect UNC3569 may develop a new payload that targets the same webview but leverages a zero-day in Chromium 80. Keep an eye on CVE disclosures related to Chromium sandbox bypasses.
  • Geopolitical fallout: Exploitation of a Tencent-owned product by a China-aligned group could attract regulatory scrutiny from both Chinese authorities and foreign governments concerned about supply-chain espionage.
  • Ecosystem response: Expect other Chinese input-method developers to audit their protocol handlers and webview implementations. The incident may accelerate a shift toward sandboxed, Chromium-based components across the industry.

Contextual Backdrop

GrayRabbit first emerged in 2024 when Google researchers identified it as a modular backdoor used by UNC3569. Its architecture allows rapid feature addition, making it a favorite for actors needing flexible espionage tools. The recent evolution includes a 64-bit build and encrypted C2 traffic, raising the bar for detection.

The Sogou flaw is a textbook example of how legacy components—here, an outdated Chromium engine—can become the Achilles’ heel of otherwise widely deployed software. Organizations that treat third-party UI libraries as “black boxes” risk blind spots that sophisticated adversaries can exploit.

Takeaways for Security Professionals

  • Patch promptly but verify the browser component’s version.
  • Isolate input-method software on critical workstations; consider disabling it where not essential.
  • Leverage threat-intel feeds that track GrayRabbit IOCs; integrate them into SIEM correlation rules.
  • Educate users about the danger of clicking custom protocol links, especially in email or messaging platforms.

For full details see the original report.