China-aligned threat group UNC3569 is actively exploiting a critical remote code execution vulnerability in Tencent’s Sogou Input Method to deliver the GrayRabbit backdoor via crafted URIs.
Researchers at cybersecurity firm Gen Digital revealed that the vulnerability, cataloged as CVE-2026-51990, affects the Windows version of Sogou Input Method. The application, developed by Tencent, is widely used across China with hundreds of millions of installations. It provides Chinese character input capabilities alongside a custom link handler and an embedded web browser engine.
According to Gen Threat Labs, the attack chain executed by UNC3569 chains three distinct weaknesses within the software. The exploitation vector begins when a target user clicks a malicious sgbiz: custom URI link. This action forces Windows to invoke the legitimate SGMyInput.exe executable through Sogou’s biz_helper.exe protocol handler while passing unvalidated command-line arguments supplied by the attacker.
In the second stage, these injected arguments open the software’s skincenter component and instruct an embedded Chromium-based webview to navigate to an attacker-controlled URL without restricting the scheme or destination. The third stage leverages an outdated and unsandboxed Chromium 80 engine, which lacks crucial web security protections. This allows the malicious page to achieve arbitrary code execution and install the GrayRabbit malware variant on the host system.
“We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link,” Gen Threat Labs stated in their technical report.
The analyzed GrayRabbit sample represents a mature 64-bit iteration featuring an expanded command set and RC4-encrypted command-and-control configurations. Its functional capabilities include executing arbitrary processes, establishing interactive reverse shells, transferring files, harvesting system telemetry, and reflectively loading memory-resident plugins.
Gen Digital disclosed the vulnerability to Tencent on April 9. In response, Tencent released Sogou Input Method version 16.3.0.3498 on April 21, which patches the URI handler issue by enforcing HTTPS usage, validating input parameters, and restricting URL navigation to approved domains. However, security researchers have cautioned that the underlying Chromium browser engine remains outdated and continues to operate without a sandbox.