Quick rundown
Heads up: security researchers found a nasty chain of issues in Tencent’s Sogou Input Method for Windows that lets attackers get code running on a target machine with a single click. The flaw is tracked as CVE-2026-51990 and has been used by a China-aligned threat group known as UNC3569 to push the GrayRabbit backdoor onto victims.
Yes, single-click. No, it’s not the kind of click you want in your life.
How the attack works (the sad, elegant engineering of it)
The exploit is a three-step chain that takes advantage of how the Sogou app handles custom links and an embedded browser. In plain terms: a specially crafted link calls Sogou, Sogou opens a built-in webview to a page the attacker controls, and that page abuses an old Chromium bug to run arbitrary code. The webview runs without a sandbox and with some security checks turned off — basically, a very cozy environment for malware.
- Unvalidated custom URI: A crafted sgbiz: link triggers a Sogou protocol handler and passes attacker-controlled command-line arguments into a legitimate Sogou executable without proper checks.
- Unrestricted webview navigation: Those arguments open a Sogou component that hosts an embedded Chromium webview and tell it to load an attacker-controlled URL. The app doesn’t limit the URL scheme or destination.
- Outdated browser exploit: The embedded Chromium engine (based on Chromium 80) contains known vulnerabilities. Because it runs unsandboxed with weakened protections, an exploit yields code execution and the attacker can drop the GrayRabbit backdoor.
The researchers who discovered this chain reported it to the vendor, and Tencent released an update that tightens which URLs the protocol handler accepts (only HTTPS and only specific Tencent/Sogou domains) and validates arguments. However, the embedded browser is still old and lacks sandboxing — so while the immediate protocol abuse was fixed, some risk remains until the engine is modernized and sandboxed.
GrayRabbit itself is modular and mature in recent samples: it can execute processes, open interactive reverse shells, transfer files, harvest system and user details, and load plugins directly into memory. Some variants also obfuscate their configuration with RC4 encoding.
If you’re wondering who’s behind the campaign, security firms link it to UNC3569 — a group that researchers associate with China and which has previously been seen operating both as a cybercrime crew and as a contractor-for-hire.
Bottom line: the immediate vector is patched if you update Sogou Input Method (the vendor pushed a fix), but the presence of an outdated Chromium engine running unsandboxed means updating the app should be combined with caution and defense-in-depth until the browser component is fully modernized.