- The Mess: A China-linked UNC3569 intrusion abused Sogou Input Method on Windows through a custom
sgbiz:protocol handler, chaining multiple design failures into code execution and a GRAYRABBIT backdoor. The vulnerability is tracked as CVE-2026-51990. - The Damage: A trusted desktop input tool became the launchpad for attacker-controlled code running with the logged-in user’s privileges.
- The Fix: Update Sogou Input Method to version 16.3.0.3498 or later — and do not assume the patch magically makes its embedded browser safe.
Sogou Input Method is not the kind of software most Windows defenders expect to see in an attack chain.
It should be.
Gen Digital found the vulnerability while investigating a real intrusion attributed to UNC3569, a China-linked threat group. The attack abused Sogou’s Windows components to turn a crafted link into a route for arbitrary code execution. The final payload was GRAYRABBIT, a lightweight backdoor that gives the operator remote command execution, file transfer and the ability to load additional modules.
The interesting part is not one spectacular memory corruption bug.
It is the chain.
Three weak design decisions lined up:
- a custom Windows protocol handler trusted attacker-controlled arguments;
- a Sogou component accepted an attacker-selected URL;
- the embedded browser was based on Chromium 80 with security protections disabled.
The result was an attack path that started outside the application and ended inside the Windows user’s security boundary.
The sgbiz: problem
Sogou Input Method is built as multiple Windows components rather than one monolithic executable.
Those components communicate through a custom URI scheme:
sgbiz:
Windows passes an sgbiz: request to Sogou’s biz_helper.exe. The helper determines which Sogou component should be launched and passes parameters to it.
That second part was the problem.
Gen found that the handler checked the requested component but did not properly validate the command-line arguments supplied with the URI. An attacker could therefore construct a link that instructed Sogou to launch a legitimate component with attacker-controlled parameters.
The target was SGMyInput.exe.
The attackers used parameters that opened Sogou’s skin-store interface and supplied a URL controlled by the attacker.
At this point, Sogou had effectively converted an untrusted hyperlink into an application-controlled browser navigation primitive.
That is a terrible place to be.
Then Chromium 80 enters the room
The skin-store interface uses an embedded browser based on Chromium Embedded Framework.
The version analyzed by Gen was effectively a Chromium 80-era browser, dating from around March 2020.
That would already be a problem.
The more serious issue was the configuration.
Gen found that important browser security mechanisms had been disabled, including the sandbox. The same-origin policy was also disabled through configuration applied by the application.
Normally, compromising a browser renderer is only one part of a browser attack.
The sandbox is supposed to make the next step harder.
Here, the application had already removed that safety barrier.
The attackers therefore did not need to break out of a modern Chromium sandbox after compromising the embedded browser. The browser was running without the isolation defenders normally expect from Chromium.
The exploit chain
The observed attack used a crafted sgbiz: link.
The chain looked roughly like this:
crafted link
↓
sgbiz:
↓
biz_helper.exe
↓
SGMyInput.exe
↓
skin store
↓
attacker-controlled URL
↓
embedded Chromium 80
↓
CVE-2021-38003
↓
code execution
↓
7-Zip DLL sideloading
↓
GRAYRABBIT
That is the part worth remembering.
CVE-2026-51990 was not the whole attack.
The attackers also used CVE-2021-38003, an old V8 vulnerability involving JSON.stringify, because the embedded Chromium engine was so old that the vulnerable code was still present.
A vulnerability fixed years ago in mainstream Chrome remained useful inside a desktop application that shipped its own browser engine.
This is exactly why application inventories that only track Chrome, Edge and Firefox versions are incomplete.
GRAYRABBIT lands
Once code execution was achieved, the operation moved into familiar malware territory.
Gen observed a small downloader retrieving three files from infrastructure hosted on Alibaba Cloud in Hong Kong:
- a legitimate 7-Zip executable;
- a malicious DLL;
- an encrypted payload.
The attackers then used DLL sideloading.
The legitimate 7-Zip executable loaded the malicious DLL from the same directory, allowing the attacker-controlled code to execute under the trusted executable’s process.
The loader also tried to make automated analysis harder.
One observed technique involved checking the number of running processes before decrypting the payload. If the environment looked too small, the loader generated the wrong decryption key and produced garbage instead of the actual payload.
That is a classic anti-analysis trick: don’t attack the sandbox. Make the malware decide whether it is worth revealing itself.
The loader subsequently used NTFS alternate data streams while cleaning up its artifacts.
The final payload was GRAYRABBIT.
It provides the operator with a remote shell, file transfer capabilities, system information collection and the ability to load additional modules.
Its command-and-control traffic was observed over TCP port 443, but the traffic was not ordinary TLS. Gen observed RC4-encrypted TCP communication instead.
Port 443 does not automatically mean HTTPS.
That remains an annoyingly effective trick.
This was a real intrusion, not a lab demo
This distinction matters.
Gen did not discover CVE-2026-51990 by randomly fuzzing Sogou and then demonstrate a theoretical exploit.
The researchers encountered the attack path during investigation of a live UNC3569 intrusion.
That means the exploit chain was operational.
The group has been associated with targeting government, education, technology and financial organizations, particularly in East and Southeast Asia. Google Threat Intelligence has tracked UNC3569 since 2021 and linked it to China’s hacker-for-hire ecosystem.
The campaign therefore illustrates something defenders repeatedly get wrong:
attackers do not care whether a piece of software looks security-sensitive.
An input method can become an initial-access mechanism.
A skin store can become an exploit delivery mechanism.
A browser embedded inside a desktop application can become an obsolete browser exposed directly to the internet.
And a legitimate copy of 7-Zip can become the first step in DLL sideloading.
Tencent patched the door
There is one piece of good news.
Tencent reacted quickly after Gen reported the vulnerability.
Gen reported CVE-2026-51990 to Tencent on April 9, 2026. Tencent acknowledged it the next day and confirmed on April 21 that a fix had been completed and distributed automatically in version 16.3.0.3498. MITRE assigned the CVE on July 10.
Twelve days from disclosure to deployed fix is actually a respectable response.
The patch changed the vulnerable link-handling path in biz_helper.exe.
The application now validates URL-bearing arguments, rejects non-HTTPS schemes and checks the destination against an allowlist of trusted domains.
So the original route into the browser was closed.
But there is a catch.
The browser was still ancient
Gen found that the patch did not replace the embedded browser engine.
The affected build still contained Chromium 80-era components, with the sandbox disabled and other browser security settings left unchanged.
That creates an uncomfortable security lesson.
A vendor can patch the entry point without fixing the component behind it.
The specific exploit chain may be dead.
The architectural weakness is not.
If an application embeds a browser engine, that engine becomes part of the application’s attack surface. Leaving it years behind mainstream browser security updates means every newly discovered browser bug has to be evaluated again against that embedded environment.
That is operational debt disguised as a feature.
What defenders should look for
Organizations using Sogou Input Method on Windows should verify that the installed version is 16.3.0.3498 or newer.
For potentially compromised systems, patching is not enough.
The GRAYRABBIT loader was designed to remove itself, so absence of the malicious DLL from disk does not prove the machine was never compromised. Gen published indicators that defenders can use for retrospective investigation.
Relevant indicators include:
29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63
Malicious DLL loader, observed as 7z.dll.
749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e
Encrypted payload named p.
d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a
GRAYRABBIT, internally named core.dll.
Other published indicators include:
mail.uaiubifas[.]top
GRAYRABBIT C2 on TCP/443.
noht1ng[.]top
Exploit-hosting domain.
8.218.50[.]207
Staging infrastructure hosted on Alibaba Cloud in Hong Kong.
C:\Users\Public\Documents\
Observed location for the downloaded files.
Security teams should also treat unexpected sgbiz: activity, unusual launches involving biz_helper.exe or SGMyInput.exe, and suspicious 7-Zip execution from user-writable directories as investigation leads.
The bigger Windows lesson
Custom URI handlers deserve more attention.
Every Windows application that registers something like:
myapp:
vendor:
sgbiz:
creates a bridge between external content and local process execution.
That bridge is not automatically dangerous.
But it becomes dangerous when developers treat the URI as trusted input.
The Sogou incident demonstrates the full failure mode:
external link → custom protocol → local executable → attacker-controlled arguments → embedded browser → outdated engine → code execution.
There was no exotic kernel exploit here.
No zero-day browser sandbox escape.
No sophisticated Windows privilege escalation.
The attackers found an application that had assembled several dangerous assumptions and connected them together.
That is often enough.
Bugstoday’s take
The interesting part of CVE-2026-51990 isn’t that Sogou had a bug.
Everyone has bugs.
The problem was architectural.
A desktop input method registered its own protocol handler, accepted attacker-controlled arguments, opened arbitrary web content, embedded a six-year-old browser engine and disabled the browser sandbox.
Then someone clicked a link.
That is not one vulnerability.
That is a chain of trust failures.
Tencent deserves credit for shipping the fix in 12 days. But closing the sgbiz: door while leaving the ancient Chromium engine underneath it is not the kind of security story defenders should celebrate too loudly.
The real lesson is broader:
If your Windows software ships a browser, you own a browser.
And attackers have noticed.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Gen Digital — technical analysis of CVE-2026-51990, UNC3569 and GRAYRABBIT.
- The Hacker News — independent reporting and technical breakdown of the exploitation chain.
- CyberHappenings — campaign timeline, remediation and vulnerability context.
