Tencent's Sogou Input Method for Windows contains a critical vulnerability tracked as CVE-2026-51990, exploited by the UNC3569 threat actor. The vulnerability chains three issues: unvalidated command-line argument injection in the protocol handler (biz_helper.exe), unrestricted URL navigation, and use of an outdated Chromium 80 browser engine with disabled sandbox and weakened security policies. Attackers send crafted sgbiz URLs that, when clicked, allow system-level code execution. This exploit has been used to deploy the GrayRabbit backdoor, which offers reverse shell access and various remote capabilities. Tencent patched the vulnerability by adding URL parameter validation in version 16.3.0.3498, but the outdated Chromium engine remains unpatched. The flaw has been actively exploited in the wild since at least April 2026.

Successful exploitation allows attackers to execute arbitrary code at the system level on affected Windows machines running Sogou Input Method. This enables deployment of the GrayRabbit backdoor, which provides attackers with a reverse shell, process execution, plugin loading, file upload capabilities, system information gathering, and self-termination. The vulnerability has been actively exploited by the UNC3569 threat group targeting various sectors globally.

Tencent released an official patch in Sogou Input Method version 16.3.0.3498 that adds validation checks for URL parameters in the protocol handler, mitigating the command-line argument injection vector. Users should ensure they have updated to this version or later via the automatic update mechanism. However, the underlying Chromium browser engine remains outdated and unpatched, so additional mitigations may be limited. No further vendor advisories indicate additional fixes or mitigations. Patch status is confirmed as fixed for the URL parameter validation issue; users should apply the update promptly.