CVE-2026-51990 is a one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows, exploited in the wild by the China-linked group UNC3569 to install the GRAYRABBIT backdoor. Gen Digital's threat researchers, who investigated the intrusion after the fact, named the identifier in their write-up published on 11 September 2026; Tencent had fixed the flaw in April 2026, before the exploitation was documented publicly.

The flaw is not a single coding error but the third stage of a chain. UNC3569 combines an unvalidated command-line argument injection in the product's sgbiz: URI handler, unrestricted URL navigation in a CEF-based webview, and an outdated, unsandboxed Chromium 80 engine bundled inside the input method. A victim clicking a crafted sgbiz: link causes Windows to invoke Sogou's biz_helper.exe protocol handler, which forwards attacker-controlled arguments to the legitimate SGMyInput.exe executable without validating them; those arguments open the skincentre component and point the embedded webview at an attacker-controlled page, which then exploits the old browser engine. Because the engine runs without a sandbox and with key web-security protections disabled, the page reaches code execution in the user's context and drops the backdoor.

Tencent's fix, shipped in Sogou Input Method 16.3.0.3498 on 21 April 2026, validates the URL arguments accepted through the protocol handler, permits only HTTPS and restricts navigation to approved Sogou and Tencent domains. Gen Digital warns that the underlying browser engine remains outdated and unsandboxed, so the patch closes the documented chain without removing the class of weakness underneath it.

Source

• Gen Digital — One-click backdoor: UNC3569 exploits Sogou Input Method