502/69 Monday, September 14, 2026
Cybersecurity researchers from Gen Digital have warned of active exploitation of a high-severity vulnerability, CVE-2026-51990, in Sogou Input Method for Windows, a Chinese input application developed by Tencent. The vulnerability is a remote code execution (RCE) flaw that can be triggered when a user clicks a maliciously crafted link, known as a one-click exploit. Successful exploitation allows the UNC3569 threat group to gain access to the target system and install the GrayRabbit backdoor. The application reportedly has hundreds of millions of installations, affecting both individual users and organizations that use it on Windows systems.
Technical analysis found that the attack chains together three weaknesses. The attacker first tricks the victim into clicking a malicious link using the special sgbiz: protocol, which launches biz_helper.exe. The process then passes command parameters to SGMyInput.exe without proper validation. This opens the skincenter component and causes it to load a malicious link through SGWebRender or CEF, which is powered by an outdated Chromium 80 engine with security features disabled and no sandbox isolation. As a result, JavaScript can process shellcode to download malicious files such as 7z.exe and 7z.dll, ultimately leading to the installation of the GrayRabbit backdoor. The malware is capable of executing processes, opening a reverse shell for remote control, transferring files, collecting system information, and loading additional plugins directly into system memory.
Although Tencent was notified and released an update in Sogou Input Method version 16.3.0.3498 to restrict URL parameters to HTTPS and approved domains only, researchers warned that the application’s embedded browser remains outdated and still lacks sandbox protection. Users and administrators are advised to update Sogou Input Method to the latest version as soon as possible, assess whether applications with embedded browsers of this type are necessary in their environments, and monitor for abnormal network activity to reduce the risk of cyberattacks.