Gen Threat Labs, the research arm of the company behind Norton and Avast, published research on 10 September 2026 into CVE-2026-51990, a remote code execution flaw in Sogou Input Method. It is the Chinese-language input software for Windows that Tencent owns, and Gen says it has hundreds of millions of installations.
Gen did not find the bug in a lab. It traced it while investigating an intrusion by UNC3569, a China-linked group tracked by Google Threat Intelligence, which was using it to install a backdoor called GRAYRABBIT.
The patch closed the door the group used. What sits behind the door is the more interesting part.
An input method with a browser inside
Sogou Input Method is not one program. It is a set of components that talk to each other through a custom link scheme, sgbiz:, which Sogou registers with Windows. When anything opens a link starting with sgbiz: — a web page, an email, a chat message — Windows hands it to a helper program, biz_helper.exe, which reads the link and launches the Sogou component it names.
Gen found three failures lined up in a row.
- The arguments were never checked. The helper carefully validated which Sogou program a link could launch, blocking path tricks and confirming the file existed. The command-line arguments passed to that program got a single round of URL decoding and nothing else.
- One page opens any address. Those arguments could tell Sogou's settings app to open its skin store, the only page in that app built on an embedded Chromium browser, and to point it at an arbitrary web address. There was no check on the scheme or the domain.
- The browser is from 2020. The embedded engine identifies itself as Chromium Embedded Framework 80, built on Chromium 80.0.3987.163, which dates from around March 2020 and is some 60 major versions behind current Chrome. Its sandbox is switched off in code, and flags that disable the same-origin policy and let pages read local files are hard-coded on.
Chained together, a single click took an attacker's page straight into a six-year-old browser engine with nothing between it and the user's account.
The exploit was a Chrome bug from 2021
UNC3569's page did not need anything new. It used CVE-2021-38003, a flaw in Chrome's V8 JavaScript engine that Google fixed in late 2021. That flaw has been in the US Cybersecurity and Infrastructure Security Agency's catalogue of known exploited vulnerabilities since 3 November 2021, the day the catalogue launched.
The exploit carried 921 bytes of machine code that fetched three files from a server on Alibaba Cloud in Hong Kong: a genuine copy of 7-Zip, a malicious library saved under the exact file name 7-Zip loads from its own folder, and an encrypted payload. Running 7-Zip was enough to load the malicious library.
The payload that decrypts to rubbish in a sandbox
The loader has a neat trick against analysis. Before decrypting its payload, it counts the running processes. Security sandboxes tend to run few; a real Windows machine usually runs dozens. If there are fewer than 50, the count is folded into the decryption key, the key comes out wrong, and the payload decrypts into garbage. On an ordinary PC the key is correct.
It then deletes itself using an NTFS alternate data stream, a method that avoids the ordinary file-deletion call behavioural monitoring watches for.
GRAYRABBIT itself is small: a remote command shell, file transfer in both directions, and plugins it can pull from its operators while running. It talks to its server on port 443, but over raw TCP encrypted with RC4 rather than over TLS.
What the patch changed, and what it did not
Gen reported the flaw to Tencent on 9 April 2026. Tencent confirmed a fix on 21 April, pushed by automatic update in version 16.3.0.3498. Twelve days from report to deployed patch is fast, and Gen says so.
The fix lives entirely in the helper. Links that pass a web address to the settings app are now rejected unless the address uses HTTPS and sits on one of four allowlisted domain suffixes: sogou.com, qq.com, woa.com and sogou. Later updates added further checks on arguments.
According to Gen, nothing about the browser changed. In the patched release the engine is the same version, the sandbox is still disabled, and the same-origin policy is still switched off. What changed is that an outsider's link can no longer steer it to an arbitrary address through this route. Its protection now rests on the checks placed in front of it.
Tencent's response, as Gen reports it, was that the impact is limited, that the chain is relatively complex, and that it depends on social engineering to get a user to approve a browser prompt. Gen's description of the chain it saw in the wild is that a single click on a link was enough.
It is the second Tencent product in the security news this week, after a zero-click flaw in WeChat's calling code.
Who UNC3569 is
Gen, drawing on Google's work, describes UNC3569 as a PRC-nexus group that favours already-known vulnerabilities in widely used software and targets government, education, technology and finance, mostly in East and Southeast Asia. Gen notes possible business relationships with i-SOON, the Chinese contractor whose internal documents leaked in early 2024. Google has documented GRAYRABBIT in the group's campaigns since at least 2021.
What to do
- Make sure Sogou Input Method is at version 16.3.0.3498 or later. It updates itself, but machines that block updates will not have the fix.
- Look for 7-Zip running from the Windows Public Documents folder with a 7z.dll beside it, and for Sogou's settings or browser-rendering processes starting unusual child processes.
- Block the published indicators: the exploit host noht1ng[.]top, the command server mail.uaiubifas[.]top on port 443, and the staging server 8.218.50[.]207.
- Treat embedded browsers as software to inventory. Desktop applications that bundle their own Chromium do not update when Chrome does.
What is not established
- How many machines were compromised, and who the victims were. Gen does not say.
- How long UNC3569 had been using the flaw before Gen found it inside an intrusion and reported it in April.
- How the crafted links reached victims.
- Whether Tencent plans to update or sandbox the embedded browser.
- Whether CVE-2026-51990 will be added to CISA's catalogue of exploited vulnerabilities. It was not listed as of the catalogue's 11 September release.
