A widely used Chinese-language input application became an unexpected route into Windows computers after attackers exploited weaknesses in its custom link handling and embedded browser. Researchers connected the campaign to UNC3569, a China-linked group associated with government, education, technology and financial-sector targeting.
The vulnerability, tracked as CVE-2026-51990, affected the Windows edition of Sogou Input Method. The software registers a custom sgbiz protocol that allows links to launch internal components. The handler validated which component could run but failed to adequately examine the command-line arguments supplied to it.
From Crafted Link to Code Execution
Attackers used the protocol to open Sogou's skin store and direct its embedded browser to an attacker-controlled page. That browser was based on Chromium 80, released in 2020, and operated without the normal sandbox and same-origin protections. The malicious page could therefore exploit an old V8 vulnerability and run code with the privileges of the signed-in Windows user.
The infection chain downloaded a legitimate copy of 7-Zip, a malicious DLL and an encrypted payload. DLL side-loading caused 7-Zip to execute the attacker's code, which then installed GRAYRABBIT. The backdoor provides remote command execution, file transfer and the ability to load additional modules.
A Patch That Does Not Remove the Architectural Risk
Tencent addressed the reported pathway in Sogou Input Method version 16.3.0.3498 by restricting URLs passed through the vulnerable handler. However, researchers reported that the embedded browser remains Chromium 80 and still has key protections disabled.
I believe this is the larger concern. Blocking one malicious URL route reduces immediate exposure, but an obsolete browser component inside a desktop application represents accumulated security debt. A different input path or future feature could make old Chromium vulnerabilities reachable again.
Recommended Actions
- Confirm that systems run Sogou Input Method 16.3.0.3498 or later.
- Investigate unusual execution of 7-Zip from public user directories.
- Monitor port 443 for non-TLS traffic associated with suspicious hosts.
- Restrict custom protocol handlers where the application is not required.
- Consider removing the software from high-risk administrative and government endpoints.
The incident demonstrates why embedded browsers must be inventoried and patched like standalone browsers. Software vendors should not treat bundled web engines as static application libraries, especially when they can process remotely controlled content.