Critical Sogou Input Method RCE Vulnerability Lets Attackers Backdoor Users

Key Takeaways

• A critical remote code execution (RCE) vulnerability (CVE-2026-51990) was discovered in Sogou Input Method for Windows.
• The flaw allowed attackers to execute the GRAYRABBIT backdoor with a single click on a malicious link.
• The vulnerability chain leveraged an insecure custom URL protocol handler and an outdated, unsandboxed Chromium browser component within Sogou Input Method.
• Hundreds of millions of users, including individuals and businesses across China, were at risk of espionage and data theft.
• Sogou developer Tencent has released a patch in version 16.3.0.3498 to address the primary exploit vector.

Critical RCE Vulnerability in Sogou Input Method Exposed Millions to Backdoor Attacks

A severe remote code execution (RCE) vulnerability, identified as CVE-2026-51990, in Sogou Input Method for Windows could have allowed attackers to compromise user systems with just a single click. This flaw transformed the widely-used Chinese-language typing tool into a direct conduit for the GRAYRABBIT backdoor, enabling espionage, data exfiltration, and complete remote control over affected computers.

Unlike complex multi-stage attacks or deceptive installers, this exploit required minimal user interaction. Victims merely needed to open a specially crafted link disseminated via phishing emails, instant messages, or malicious websites. Upon clicking, Windows would pass the request to Sogou Input Method, where an insecure handling mechanism for the link would inadvertently open an attacker-controlled web page.

Discovery and Attack Chain Details

Researchers at Gen Digital uncovered this critical vulnerability during their investigation into an active intrusion linked to the threat group UNC3569. Their analysis revealed that three distinct weaknesses could be chained together to form a potent one-click RCE attack. This allowed malicious code to execute with the same privileges as the logged-in Windows user.

Gen Digital said in a report shared with Cyber Security News (CSN) that the widespread adoption of Sogou Input Method, which serves hundreds of millions of users in China across various sectors, underscored the significant impact of this vulnerability.

The core of the vulnerability lies in Sogou Input Method’s use of a custom Windows link type, “sgbiz,” for internal component communication. When such a link is activated, the bizhelper.exe program is responsible for parsing its parameters and launching the appropriate Sogou component. While bizhelper.exe correctly validated the program name to be launched, it critically failed to scrutinize additional command-line instructions provided within the link. Attackers exploited this oversight to inject arbitrary commands.

This vulnerability enabled attackers to instruct Sogou’s configuration application to open its skin marketplace page. This page, crucially, incorporates an embedded Chromium-based browser. The application’s failure to restrict navigation to only trusted Sogou domains meant that it would accept any external URL specified by the attacker. This effectively turned a trusted application into a vehicle for rendering hostile web content.

The embedded browser component presented an even graver risk. It was based on Chromium 80, a version from 2020, and was found to have its sandbox disabled, along with other vital web security protections. This configuration allowed a JavaScript exploit to bypass the browser’s normal boundaries and execute code directly on the host system, a risk that has been highlighted in recent security reports concerning the V8 engine.

In the observed attacks, UNC3569 leveraged a known V8 flaw, CVE-2021-38003, to seize control of the outdated browser. The malicious code then proceeded to download additional files and employ DLL sideloading. This technique involves a legitimate program loading a rogue companion DLL file, making the malicious activity appear as normal Windows software behavior. This method’s effectiveness has been demonstrated in various campaigns, including analyses of AsyncRAT sideloading attacks.

Patch, Hunting, and Risk Reduction

The exploit chain was actively utilized to deploy the GRAYRABBIT backdoor. This sophisticated backdoor is capable of establishing contact with its command-and-control servers, collecting system information, executing arbitrary commands, opening an interactive command shell, transferring files, and loading further modules. This provides intruders with a robust and flexible foothold on compromised systems following the initial breach.

Tencent, the developer of Sogou Input Method, released a fix for the vulnerability in version 16.3.0.3498, which was deployed via automatic updates, approximately 12 days after receiving the disclosure. The patch specifically blocks unsafe URL-bearing options at the protocol-handler level, restricting accepted HTTPS addresses to only those with approved hostnames. However, the researchers noted that the embedded Chromium browser remained outdated, unsandboxed, and still had web security restrictions disabled, suggesting potential lingering risks.

What You Should Do

• Update Immediately: Ensure your Sogou Input Method is updated to version 16.3.0.3498 or a later release. Configure your system to apply future updates promptly.
• Exercise Caution with Links: Be extremely wary of unexpected links, even if they appear to originate from legitimate sources or seem to launch familiar desktop applications. Verify the legitimacy of links before clicking.
• Monitor for Suspicious Activity: Organizations should review endpoint telemetry for unusual launches of Sogou components, unexpected child processes, and abnormal outbound network connections.
• Implement Network Defenses: Reinforce link-filtering mechanisms at the network perimeter and educate users on identifying and reporting potential social engineering attempts.
• Threat Hunting: Utilize the provided Indicators of Compromise (IoCs) to search historical logs, endpoint records, DNS activity, and proxy data for any signs of compromise. Blocking known hostile infrastructure, isolating suspected devices, and investigating related process activity are crucial steps to contain any potential intrusion.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.