MalwareTips News Update Sogou Input Method After One-Click Flaw Was Exploited

[News Now]

A critical Sogou Input Method flaw allowed attackers to run code after a Windows user clicked a crafted link. Gen Threat Labs says the weakness affected software installed hundreds of millions of times and was exploited in real attacks.

Important

Tencent has fixed the vulnerability, so Sogou Input Method users should install the latest available update and avoid postponing it.

Who is affected​

The issue, tracked as CVE-2026-51990, concerns the Windows version of Sogou Input Method, a widely used Chinese-language input method editor. It is especially relevant to people and organizations using the software in China.

• Update Sogou Input Method through its official update mechanism or another trusted Tencent source.
• Treat unexpected links that ask to open Sogou components as suspicious, particularly those received through email, messages or webpages.
• Organizations should check whether affected systems launched Sogou’s configuration and web-rendering components after users opened unsolicited links.

Three weaknesses formed one exploit​

According to Gen Threat Labs researcher Alexandru-Cristian Bardaș, the attack chained three problems. Sogou’s custom link handler accepted unchecked command-line arguments, its embedded web view could open an attacker-selected address, and that view used an old Chromium engine without its sandbox.

A sandbox isolates browser content from the rest of the system. Disabling it did not remove every protection on the PC, but it meant a successful browser exploit could act with the signed-in user’s privileges.

Exploitation was observed​

Gen Threat Labs traced the flaw while investigating an active intrusion attributed to UNC3569. In the observed campaign, a malicious page exploited a known V8 JavaScript engine vulnerability because Sogou bundled Chromium 80, an approximately March 2020 release.

The attack then downloaded and launched the GRAYRABBIT backdoor. The researchers said the whole initial exploit chain required no interaction beyond clicking the crafted link.

 

[News Now]

Windows users with Sogou Input Method should update it promptly after attackers exploited a critical flaw through crafted links. A victim only had to click once for the attack to run code with their current Windows account permissions.

Important

Do not open unexpected links beginning with “sgbiz:”. Such links can launch Sogou components through its registered Windows protocol handler.

Who is affected and what to do​

Sogou Input Method is a widely used Chinese-language input method editor for Windows, with hundreds of millions of users. Tencent, which owns and develops the software, fixed the vulnerability in a subsequent update.

• Install the latest Sogou Input Method update; the flaw is tracked as CVE-2026-51990.
• Treat unsolicited “sgbiz:” links in email, messages and webpages as suspicious, even when they appear to open a legitimate Sogou feature.
• If you may have clicked one, check C:\Users\Public\Documents\ for 7z.exe, 7z.dll or a file named p, then run a full security scan.

Three weaknesses enabled the attack​

Gen Threat Labs found that the “sgbiz:” handler accepted unchecked command-line arguments, allowing a crafted link to start Sogou’s configuration app with attacker-chosen options. Its skin marketplace could then open an arbitrary web address without checking the address type or domain.

The page opened inside Chromium 80, an embedded browser engine dating from around March 2020. Its sandbox—a barrier intended to stop compromised web content from reaching the operating system—was disabled, so successful exploitation provided the permissions of the signed-in user rather than automatically granting administrator access.

UNC3569 deployed GRAYRABBIT​

The researchers traced the flaw while investigating an active intrusion attributed to UNC3569, a China-linked group. The observed page at noht1ng.top exploited CVE-2021-38003, an older Chrome JavaScript engine flaw that remained effective against Sogou’s bundled Chromium 80.

The attack downloaded a legitimate 7-Zip program, a malicious 7z.dll and an encrypted payload into C:\Users\Public\Documents\. Launching 7z.exe caused the nearby malicious DLL to load, ultimately delivering the GRAYRABBIT backdoor.