Author: DigitalSpying Security Desk
Date: September 14, 2026
Executive Summary
A critical zero-day exploit chain affecting Tencent's Sogou Input Method—one of the most widely deployed Chinese-language input method editors (IMEs) for Windows, boasting hundreds of millions of users—has been weaponized in the wild by state-sponsored cyber espionage operators. As documented in technical research from Gen Threat Labs and reported by SecurityWeek, the vulnerability tracked as CVE-2026-51990 enables unauthenticated, one-click Remote Code Execution (RCE) with the privileges of the logged-in desktop user.
China-nexus Advanced Persistent Threat (APT) group UNC3569 (associated with private intelligence contractor i-SOON) actively exploited the flaw to target government, technology, financial, and educational organizations worldwide. By chaining command-line argument injection within Sogou's custom URI scheme handler with an outdated, un-sandboxed embedded Chromium engine, adversaries execute system commands and establish persistence via the GrayRabbit backdoor simply by enticing victims to click a specially crafted hyperlink.
Deep-Dive Technical Analysis
1. Attack Architecture: The Three-Stage Exploit Chain
The vulnerability (CVE-2026-51990) exploits the architectural interaction between Windows protocol handlers, parameter parsing, and legacy embedded browser engines:
Stage 1: Custom URI Protocol Handler Parameter Injection
* Protocol Registration: During installation on Windows, Sogou Input Method registers a custom system protocol scheme named sgbiz://.
* Parsing Vulnerability in biz_helper.exe: When a user clicks an sgbiz:// link in any Windows application (browser, chat client, document), the OS launches Sogou’s protocol dispatcher, biz_helper.exe.
* Argument Injection (CWE-88): While parsing the URI query parameters, biz_helper.exe extracts the param parameter without sanitizing control characters or command-line switches. An attacker crafts a URL embedding arbitrary switches (e.g., --user-data-dir, --load-extension, or --app) directly within the param parameter, causing biz_helper.exe to forward these injected flags into child execution subroutines.
Stage 2: Forced Browser Navigation & Skin Center Hijack
* The injected arguments declare a specialized internal application context, specifically invoking Sogou’s skincenter window routine.
* The internal dispatcher blindly copies the remote URL provided by the attacker and directs the internal GUI renderer to navigate to the attacker's web server rather than legitimate Tencent content delivery networks (CDNs).
Stage 3: Exploiting Legacy, Un-Sandboxed Chromium 80 Engine
The root enabler of full system takeover lies in Sogou’s underlying web rendering engine:
* Legacy Browser Codebase: The internal web views inside Sogou Input Method are powered by a legacy build of Chromium 80, dating back to March 2020. This engine lacks roughly six years of upstream security patches and memory-safety mitigations.
* Disabled Sandbox Architecture: Chromium’s multi-process sandbox—the core boundary preventing compromised renderers from touching the local operating system—is completely disabled (--no-sandbox).
* Stripped Web Security Boundaries: Sogou developers disabled the Same-Origin Policy (SOP) and enabled local file system access permissions (file:// schema reads). Once the engine loads the attacker's remote web page, simple JavaScript primitives achieve deterministic native code execution without requiring memory corruption or browser exploit primitives.
Exploit Component
Technical Detail
Vulnerability ID
CVE-2026-51990
Weakness Type
CWE-88 (Argument Injection)
Primary Process
biz_helper.exe
URI Scheme
sgbiz://
Rendering Engine
Chromium 80 (Outdated/Un-sandboxed)
Target User Context
Logged-in Desktop User
2. Threat Actor Attribution & GrayRabbit Backdoor
Gen Threat Labs observed the vulnerability being actively weaponized by UNC3569:
* Actor Profile: UNC3569 is a cyber espionage group with operational links to private intelligence contractors, notably i-SOON. The cluster has historically conducted espionage campaigns across Southeast Asia, North America, and Europe.
* The GrayRabbit Implant: The primary payload delivered in the campaign is the GrayRabbit backdoor, an established modular implant in the actor’s toolkit since at least 2021.
* Capabilities: GrayRabbit establishes an interactive reverse command shell, loads external DLL plugins, monitors system processes, uploads stolen files to external command-and-control (C2) servers, and executes self-termination commands upon detecting forensic debugging environments.
3. Software Remediation & Residual Vulnerability Exposure
* Vendor Patch: Tencent patched the issue in Sogou Input Method version 16.3.0.3498, distributed via its automatic update service.
* Residual Risk: Gen Threat Labs highlighted that while Tencent’s hotfix added input validation for URL-bearing switches within biz_helper.exe, the underlying Chromium 80 engine and its insecure configuration flags (--no-sandbox) were not modernized. Organizations relying on legacy desktop applications that bundle unmaintained, un-sandboxed browser frameworks face systemic exposure.
Industry Impact & Enterprise Threat Assessment
* Ubiquitous Desktop Footprint: Chinese input method editors are standard software installations for multilingual staff, overseas offices, and cross-border commercial enterprises. Because IMEs integrate deeply into operating system keystroke processing pipelines, flaws in IME suites provide exceptionally high-value initial access vectors.
* Enterprise Protocol Handler Blindspots: Many corporate endpoint detection and response (EDR) agents do not treat URI protocol handler invocations (such as custom browser schemes) with the same behavioral scrutiny applied to macro execution or script interpreters.
Actionable Recommendations & Endpoint Hardening
1. Mandatory Application Updates
* Verify that all endpoints utilizing Sogou Input Method have been updated to version 16.3.0.3498 or higher.
* Audit corporate software inventories for unmanaged installations of consumer IMEs on company-owned laptops.
2. Protocol Scheme Restrictions in Windows Registry
Organizations operating in high-security environments should consider unregistering or restricting untrusted custom URI handlers:
* Review Windows Registry entries under HKEY_CLASSES_ROOT\sgbiz and evaluate removing execution permissions if custom web protocol features are not required.
3. Threat Hunting for GrayRabbit Indicators
Security Operations Center (SOC) teams should audit endpoint telemetry for suspicious parent-child process relationships:
* Alert on instances where biz_helper.exe or SogouCloud.exe spawns command interpreters (cmd.exe, powershell.exe, or rundll32.exe).
* Hunt for anomalous outbound network connections originating from IME process binaries or newly dropped binaries executing from %APPDATA% or %TEMP%.
Sources and Reference Intelligence: SecurityWeek, Gen Threat Labs, NIST National Vulnerability Database.