CVE-2026-51990: Sogou Input Method URL-Handling Flaw Used by APT to Drop GRAYRABBIT Backdoor

Gen Digital disclosed that China-linked UNC3569 exploited Sogou Input Method for Windows URL-handling flaw CVE-2026-51990 for one-click execution, implanting the GRAYRABBIT backdoor. Tencent patched the entry point in 16.3.0.3498.

Gen Digital published a report on 11 September disclosing that China-linked threat group UNC3569 exploited a URL-handling flaw in Sogou Input Method for Windows, CVE-2026-51990, for one-click execution and delivery of the GRAYRABBIT backdoor. Sogou Input Method has more than 455 million MAU. Tencent patched it on 21 April in version 16.3.0.3498.

Incident Overview

The vulnerability is command injection, affecting Windows versions below 16.3.0.3498.

• CVE-2026-51990, CVSS 8.8. Payload: GRAYRABBIT backdoor with remote command execution and module-loading capability;
• Threat group UNC3569 has been tracked by Google Threat Intelligence since 2021. Targets: government, education, technology, and finance in East and Southeast Asia.

Technical Details

The full chain concatenates three independently non-fatal defects into a complete execution path.

Link 1: Custom URL-protocol parameter pass-through

Windows Sogou Input Method comprises multiple components that communicate via custom URL protocol `sgbiz:`. Any such link is handed to `biz_helper.exe`. The component checks which Sogou program to launch but does not validate command-line arguments passed with the link. An attacker can therefore specify launching the settings program `SGMyInput.exe` with arbitrary arguments.

Link 2: Skin-store arbitrary URL navigation

The settings program opens the skin-store UI—the only place it launches a browser window—and navigates the browser to the supplied URL with no validation. Attackers use this to point the embedded browser at their own page.

Link 3: Embedded Chromium 80 with sandbox disabled

The browser is neither Edge nor Chrome; it is Sogou's own build of Chromium 80 (~March 2020). Gen Digital found that sandbox and same-origin policy protections are disabled at the code level. Attackers can reuse CVE-2021-38003—a V8 type-confusion bug patched in Chrome 95 (October 2021)—to execute arbitrary code as the logged-in user.

Payload delivery

After successful exploitation, the downloader pulls a legitimate 7-Zip, a malicious DLL (saved as `7z.dll`), and an encrypted payload from Alibaba Cloud Hong Kong address `8.218.50[.]207` into the Public Documents directory. Launching 7-Zip triggers DLL search-order hijacking. The backdoor connects to `mail.uaiubifas[.]top:443`, using RC4-encrypted cleartext TCP rather than TLS. Indicators:

`7z.dll     29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63
C2         mail.uaiubifas[.]top:443 (RC4 not TLS)
Staging server   8.218.50[.]207`

Impact Assessment

Tencent's fix is entry-point only: patched `biz_helper.exe` checks two URL-carrying parameters, rejects non-HTTPS links, and restricts hostnames to four domain suffixes: sogou.com, qq.com, woa.com, sogou. The embedded browser engine was not updated—sandbox still off, same-origin policy still hardcoded off, engine still Chromium 80.

Entry is blocked; attack surface is not eliminated. Of 41 Chromium V8 vulnerabilities in the CISA KEV catalog, at least 32 were patched in versions later than Sogou's embedded engine. If an attacker finds XSS on an allowed domain, the same chain can be reused.

Remediation

• Immediately upgrade Sogou Input Method for Windows to 16.3.0.3498 or later;
• Network: alert on non-TLS traffic on port 443; RC4 signatures as supporting signal;
• Host: monitor suspicious DLLs under Public Documents and anomalous placement of legitimate 7-Zip;
• DNS: block `uaiubifas[.]top` and `noht1ng[.]top`.

References

• Gen Digital One-click backdoor: Sogou
• The Hacker News China-Linked UNC3569 Exploited Sogou Input Method Flaw