A Critical Tencent Software Flaw Has Been Exploited by Chinese Hackers for System-Level Code Execution
A devastating vulnerability in Sogou Input Method, a popular Chinese-language input method editor (IME) developed by Tencent, has been used by a Chinese threat actor to deploy a powerful backdoor. The flaw, tracked as CVE-2026-51990, was exploited through a one-click attack that leveraged three interconnected security weaknesses.
Sogou Input Method is used by hundreds of millions of Windows users worldwide, making it a prime target for hackers. The software’s protocol handler, biz_helper.exe, parses URLs and dispatches them to the appropriate component. However, the critical flaw in Sogou Input Method allowed an attacker to inject command-line arguments into the URL, which were then executed by the program without any validation or sanitization.
The problem lies in the outdated Chromium browser engine used by Sogou Input Method. The current version is based on Chromium 80, released in March 2020, and lacks crucial security patches from the past six years. Moreover, the sandboxing feature is completely disabled, stripping away additional protections like same-origin policy. This created a perfect storm of vulnerabilities that could be exploited by an attacker.
A Chinese threat group known as UNC3569 has been linked to this exploit chain. According to Gen Threat Labs, UNC3569 used crafted sgbiz URLs to send unsuspecting victims to the attackers’ servers. Once clicked, the exploit provided the attackers with system-level code execution and access to sensitive data. The GrayRabbit backdoor, deployed by the attackers, allows them to collect system information, upload files, execute processes, and load plugins.
The vulnerability was reported to Tencent on April 9, and a patch was released in Sogou Input Method version 16.3.0.3498. However, as of September 10, the underlying Chromium configuration has not been updated. This means that users who have not manually updated their software are still vulnerable to this exploit.
The exploit highlights the importance of keeping software up-to-date and patching vulnerabilities in a timely manner. It also underscores the need for software developers to prioritize security features like sandboxing and same-origin policy. As cybersecurity threats continue to evolve, it’s crucial for users to stay vigilant and take proactive measures to protect themselves from potential attacks.
In light of this exploit, we recommend that Sogou Input Method users update their software immediately to the latest version. Additionally, consider using a reputable antivirus program to scan your system for any malware or backdoors. By taking these simple steps, you can significantly reduce your risk of falling victim to sophisticated cyberattacks like this one.
Source: SecurityWeek — 2026-09-14