A critical vulnerability in a popular Chinese-language input method editor has been exploited by a state-sponsored threat actor, giving attackers the ability to deploy a backdoor with just one click. The flaw, tracked as CVE-2026-51990, affects Sogou Input Method, developed by Tencent and used by hundreds of millions of Windows users worldwide.
The vulnerability is a masterclass in how a combination of security weaknesses can be exploited for devastating results. At its core, the issue lies with the protocol handler, which parses URLs and dispatches them to relevant components without proper validation or sanitization. This allowed attackers to inject command-line arguments into the URL, enabling the execution of arbitrary code.
But that’s just the beginning. The vulnerability also relies on the fact that Sogou Input Method is based on an outdated version of Chromium, which has been missing security patches for six years. To make matters worse, the browser engine in question has its sandbox completely disabled, stripping away additional protections and allowing URLs to read other local files.
The China-linked threat actor UNC3569 has been using this exploit chain to send crafted sgbiz URLs to unsuspecting victims. Once clicked, the attackers gain system-level code execution, which can be used to deploy a backdoor known as GrayRabbit. This malware provides attackers with a reverse shell and allows them to execute processes, load plugins, write data to the interactive shell, upload files, collect system information, and more.
The good news is that Tencent has addressed the vulnerability in Sogou Input Method version 16.3.0.3498, which was rolled out automatically to all users. However, as of September 10, the underlying Chromium configuration remains unchanged, leaving users vulnerable if they are not running the latest version of the software.
The GrayRabbit backdoor has been observed in UNC3569’s attacks since at least 2021 and is believed to be linked to Chinese private contractor company i-SOON. The threat actor has a history of exploiting vulnerabilities in popular software to attack government, education, technology, and finance organizations globally.
This incident serves as a stark reminder that even the most widely used software can harbor critical vulnerabilities, and it’s essential for users to stay up-to-date with the latest security patches. Furthermore, the exploit chain demonstrates the importance of proper validation and sanitization of user input, as well as the need for timely updates to prevent attacks.
As a practical takeaway, we recommend that all Sogou Input Method users update their software to the latest version immediately, even if they’re running an older version with the fix already applied. Additionally, users should be cautious when clicking on URLs from unknown sources and avoid using outdated or unpatched software. By taking these precautions, you can significantly reduce your risk of falling victim to this type of exploit.
Source: SecurityWeek — 2026-09-14