CVE-2026-51990 in Sogou Input Method Used to Deploy GRAYRABBIT Backdoor

Gen Digital researchers described the real-world exploitation of a vulnerability in Sogou Input Method for Windows. Clicking a malicious link allowed code to run in the user’s context.

The CVE-2026-51990 vulnerability in Sogou Input Method for Windows was reportedly exploited in a real-world incident to deploy the GRAYRABBIT backdoor, according to an analysis by Gen Digital. Researchers attribute the activity to a group identified as UNC3569. The risk affected unpatched installations: after a user interacted with a malicious link, an attacker could execute code with the privileges of the logged-in account.

Gen Digital said Tencent fixed the affected entry point in the biz_helper.exe process. The fix was distributed through an automatic update on April 21, 2026, in Sogou Input Method version 16.3.0.3498. Public materials, however, do not specify the full range of vulnerable versions or the number of affected organizations or users.

How the CVE-2026-51990 vulnerability worked

The attack chain began with a link using the custom sgbiz: protocol. This mechanism could launch a Sogou Input Method component and pass it parameters pointing to an attacker-controlled URL. Gen Digital observed SGMyInput.exe launching with the -page=skincenter and -url parameters.

The content opened this way then allowed code to run in the context of the currently logged-in user. In the analyzed incident, the result was the GRAYRABBIT backdoor, a tool that provides an attacker with remote access to the compromised device.

The term “one-click” attack should be understood precisely: the user had to click the malicious link. According to the cited response, Tencent also said the attack required social engineering to persuade the user to authorize the browser prompt. It was therefore not an attack that occurred entirely without victim interaction.

The fix blocks the observed path, not all risky elements

According to Gen Digital, version 16.3.0.3498 blocks the observed technique using the external protocol and an attacker-controlled URL. Researchers warned, however, that the integrated Chromium 80 and some dangerous CEF framework settings remained unchanged. The analysis therefore does not claim that all potential security risks related to the embedded browser were eliminated.

It has also not been confirmed that the specific flaw continued to be actively exploited after the April fix. The attribution of UNC3569 to China is an assessment by researchers and secondary sources, not a publicly confirmed attribution of the activity to state authorities.

What administrators should check

The first step is to verify that devices running Sogou Input Method for Windows use at least version 16.3.0.3498. In enterprise environments, this type of input software may fall outside standard application inventories and patching processes.

  • Check telemetry for links opening the sgbiz: protocol.
  • Look for SGMyInput.exe launching with the -page=skincenter and -url parameters.
  • Investigate subsequent suspicious processes launched from public directories.
  • Compare network and file artifacts with indicators from the research, including the domains noht1ng[.]top and mail.uaiubifas[.]top, as well as files disguised as 7-Zip components.

A separate Tencent announcement about affected versions or potential hardening of the embedded browser could provide further details. For now, the published Gen Digital analysis provides technical indicators that can be used to search for signs of compromise.

Sources

  • Gen Digital – Researchers’ primary technical analysis: CVE-2026-51990, observed exploitation, GRAYRABBIT, the reporting timeline, and a description of the fix.
  • SecurityWeek – Current secondary coverage of the disclosure and its security significance.
  • The Hacker News – Independent secondary summary of the attack technique, available fix, and remaining uncertainties.

Verified and updated: September 14, 2026, 15:25

Tags
Sharing

Súvisiace