Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution
Chinese threat actors are exploiting a critical vulnerability in Tencent's Windows input method editor, allowing for remote code execution with a single click.
A critical-severity vulnerability in Sogou Input Method, a widely used Chinese-language input method editor developed by Tencent for Windows, has been exploited by a Chinese threat actor to deploy a backdoor. This popular software, utilized by hundreds of millions of users, communicates through a custom protocol scheme named sgbiz. The protocol handler, biz_helper.exe, is responsible for parsing URLs and dispatching them to the appropriate component.
The flaw, tracked as CVE-2026-51990, is a chain of three security weaknesses that enables a one-click exploit. It involves unvalidated command-line argument injection, unrestricted URL navigation, and the use of an outdated, un-sandboxed Chromium browser engine. The initial vulnerability arises from the protocol handler's failure to sanitize or validate the 'param' parameter in URLs, which dictates command-line arguments passed to executables. This allows attackers to inject arguments to declare a 'skincenter' page, which is then navigated to by another function.
Compounding the issue, the browser component within Sogou Input Method is based on a Chromium 80 iteration from March 2020. This version is missing approximately six years of security patches, has its sandbox completely disabled, strips additional security protections like the same-origin policy, and permits URLs to read local files. This outdated and insecure browser environment is a key enabler for the exploit chain.
The China-linked threat actor UNC3569 has been observed actively exploiting this vulnerability in the wild. They use crafted sgbiz URLs to target unsuspecting victims. Upon clicking such a URL, the exploit chain is triggered, granting the attackers system-level code execution without requiring further user interaction.
UNC3569 is known for exploiting vulnerabilities in popular software to target global government, education, technology, and finance organizations. The group is potentially linked to the Chinese private contractor company i-SOON. The exploit chain was used to deploy the GrayRabbit backdoor, a tool consistently observed in the threat actor's intrusions since at least 2021.
The GrayRabbit backdoor provides attackers with a reverse shell, enabling them to execute processes, load plugins, write data to the interactive shell, upload files to command-and-control (C&C) servers, collect system information, and terminate itself. Its presence indicates a sophisticated and persistent threat actor.
Gen Threat Labs reported CVE-2026-51990 to Tencent on April 9. The vulnerability was addressed in Sogou Input Method version 16.3.0.3498, which was automatically deployed to users. However, the fix primarily involved adding a check for URL-bearing switches in the protocol handler, while the underlying Chromium configuration and its outdated version remain unaddressed as of September 10, according to Gen Threat Labs.
This incident highlights the significant risks associated with using software that relies on outdated or unpatched components, especially when combined with insecure protocol handling. The widespread use of Sogou Input Method makes this vulnerability a considerable threat, potentially leading to broad system compromise by sophisticated threat actors.
The new article provides specific technical details on the attack chain, including the use of an outdated and unsandboxed Chromium browser component (version 80) within Sogou Input Method. It highlights that a known V8 engine flaw (CVE-2021-38003) was leveraged to escape the browser's sandbox and execute code on the host system, ultimately deploying the GRAYRABBIT backdoor via DLL sideloading. Additionally, the article includes detailed indicators of compromise (IoCs) for threat hunting.