Sogou Input Method Windows link-handler code-execution flaw (CVE-2026-51990)
Vulnerability
Summary
Hide ▲
Show ▼
CVE-2026-51990 is a critical one-click RCE in Tencent’s Sogou Input Method for Windows that UNC3569 exploited through a crafted sgbiz: link to load a malicious page and deploy the GRAYRABBIT backdoor. Gen Digital said the chain used biz_helper.exe, SGMyInput.exe, and an outdated, unsandboxed Chromium 80 browser path with disabled web-security protections to reach code execution. Gen reported the issue to Tencent on April 9, 2026, and Tencent completed a fix in version 16.3.0.3498 on April 21, 2026. The patch validates protocol-handler URL arguments, allows only HTTPS, and restricts navigation to approved Sogou and Tencent domains, while the broader browser-engine weakness remained in place.
Cases
Related Happenings
UNC3569 Sogou Input Method exploitation campaign
Campaign
H score89
First: 11.09.2026 10:14
Last: 11.09.2026 10:14
Sources 1
How related:
"We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link,"
About this happening:
UNC3569 is using a crafted sgbiz: link to exploit Tencent’s Sogou Input Method for Windows and deploy the GRAYRABBIT backdoor. Gen Digital says the activity involv...
UNC3569 Sogou Input Method exploitation campaign
CampaignHow related: "We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link,"
About this happening: UNC3569 is using a crafted sgbiz: link to exploit Tencent’s Sogou Input Method for Windows and deploy the GRAYRABBIT backdoor. Gen Digital says the activity involv...
Isolated-vm ExternalCopy type confusion GHSA-864f-rcv7-6rh4 remote code execution flaw
Vulnerability
H score16
First: 20.08.2026 16:48
Last: 20.08.2026 16:48
Sources 1
About this happening:
isolated-vm users face a critical ExternalCopy type confusion flaw that can let sandboxed JavaScript escape into the host process and corrupt memory across all versi...
Isolated-vm ExternalCopy type confusion GHSA-864f-rcv7-6rh4 remote code execution flaw
VulnerabilityAbout this happening: isolated-vm users face a critical ExternalCopy type confusion flaw that can let sandboxed JavaScript escape into the host process and corrupt memory across all versi...
Timeline
-
11.09.2026 10:14 1 articles · 13d ago
Gen Digital reports Sogou Input Method flaw to Tencent
Initial DisclosureGen Digital reported the Sogou Input Method Windows flaw to Tencent on April 9, 2026 after investigating a live intrusion tied to UNC3569; the issue is tracked as CVE-2026-51990.
Show sources
- China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor — thehackernews.com — 11.09.2026 10:14
-
11.09.2026 10:14 1 articles · 13d ago
Tencent completes Sogou Input Method fix and automatic update
Mitigation Patch UpdateTencent confirmed on April 21, 2026 that a fix for Sogou Input Method version 16.3.0.3498 was complete and would reach users through automatic update.
Show sources
- China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor — thehackernews.com — 11.09.2026 10:14
-
11.09.2026 10:14 3 articles · 13d ago
Gen Digital details UNC3569 Sogou Input Method exploitation and GRAYRABBIT delivery
Technical Analysis UpdateGen Digital published research on September 11, 2026 describing a UNC3569 campaign that used a crafted sgbiz: link against Sogou Input Method on Windows to install GRAYRABBIT and execute code with the logged-in user's privileges; the attack page also carried an exploit for CVE-2021-38003.
Show sources
- China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor — thehackernews.com — 11.09.2026 10:14
- China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor — thehackernews.com — 11.09.2026 10:14
- Hackers exploit Tencent app flaw to deploy GrayRabbit malware — www.bleepingcomputer.com — 13.09.2026 17:26