A single click on a link was all it took. Researchers at Gen Threat Labs found that a crafted web address could reach inside Sogou Input Method, one of the most widely used Chinese-language typing tools for Windows, and run an attacker's code on the machine behind it. The software has hundreds of millions of installations.
They did not find it in a lab. They found it while taking apart a live intrusion.
The flaw, tracked as CVE-2026-51990, is not one mistake but three, stacked on top of each other. Gen's report, published on September 10 and written by threat analysis engineer Alexandru-Cristian Bardas, walks the chain from a custom Windows link handler to a browser engine that has not been updated since 2020. Tencent, which owns and develops Sogou Input Method, has shipped a fix. Peru's national digital security centre carried the finding into its September 16 bulletin, a sign the issue is being flagged well beyond China.
Found inside a live intrusion
Gen's team was investigating an intrusion by UNC3569 when it traced the initial access to something it did not expect: the process chain started inside Sogou Input Method. UNC3569 is a PRC nexus group documented by Google Threat Intelligence, which describes a crew that prizes operational efficiency, routinely exploits n-day flaws (bugs that are already public and already patched) in widely used software, and runs a mix of custom malware and commercial tooling. Google's researchers have tracked its operations against government, education, technology and finance targets worldwide, concentrated in East and South East Asia, and have noted potential business relationships with i-SOON, the Chinese contractor whose internal communications leaked in early 2024.
Nobody checked the arguments
Sogou Input Method is not one program. It is a set of components that talk to each other through a custom Windows link scheme, sgbiz:. When anything on the system opens an sgbiz: address, Windows hands it to a small helper program, biz_helper.exe, which reads the address and starts the right Sogou component.
That helper checks one thing carefully and another not at all. The parameter naming which Sogou program to launch is scrubbed for path traversal characters, length limited, resolved against the install directory, and confirmed to exist on disk. The parameter carrying the command line arguments for that program gets a single URL decode and nothing else. No filtering, no allowlist, no checks. An attacker could not choose a new program, then, but could tell a legitimate Sogou program to do something it was never meant to do.
The skin store opens any address
The program they told it to was SGMyInput.exe, the configuration app. Most of its pages draw ordinary Windows dialogs. One does not. The skin marketplace page is the only code path in the program that creates an embedded browser view, and when that view starts it checks whether a custom address arrived on the command line. If one did, it navigates there. Gen found no scheme check, no domain allowlist and no validation of any kind, so the attacker's address flowed from the link, through the helper, and into a browser.
A browser engine from 2020
That browser reports itself as CEF 80.1.16, built on Chromium 80.0.3987.163. Gen dates the build to roughly March 2020, which put it about sixty major versions behind the Chromium stable channel at the time of the analysis, and six years short on security fixes.
Age alone would be bad. The configuration is worse. Gen found the Chromium sandbox switched off in code, and a set of switches appended on every start that include disable-web-security, which turns off the same origin policy that normally stops one site reading another's data, and allow-file-access-from-files, which lets a loaded page read local files. The flag controlling those switches is hardcoded rather than configurable. So there is no sandbox to contain a browser exploit, and no origin boundary behind it either.
Put the three together and the attack is just a link. Windows hands the address to the helper, the helper passes the unchecked arguments to the configuration app, the configuration app opens the skin store's browser at the attacker's page, and that page runs a JavaScript exploit against an engine that is years out of date with nothing underneath it.
What UNC3569 did with it
In the campaign Gen observed, the exploit page sat on noht1ng[.]top and served an exploit for CVE-2021-38003, a V8 type confusion bug in JSON.stringify that Chrome fixed in version 95.0.4638.69. Against a bundled Chromium 80, a five-year-old browser bug still lands. V8 remains hard to keep safe even in browsers that update constantly, as Chrome's own recent emergency fixes show. Inside a frozen engine it is a solved problem for the attacker.
The exploit dropped 921 bytes of downloader shellcode, which pulled three files from a staging server at 8.218.50[.]207, hosted on Alibaba Cloud in Hong Kong, into the public documents folder. Two of them were a legitimate 7-Zip binary and a trojanized library written to disk under the name 7-Zip expects to load. Running the real 7-Zip loaded the fake library, a technique called DLL sideloading that we have covered in other China-nexus operations. The archive command it ran was irrelevant. Starting the process was the point.
The loader counted how many processes were running before it would decrypt anything. Fewer than fifty, and it deliberately computed the wrong key so the payload unpacked into garbage, a cheap way to waste an analyst's sandbox. It then removed itself using an NTFS alternate data stream rename rather than a delete call, so no file deletion appears in behavioural logs.
The payload is GRAYRABBIT, a compact C++ backdoor that Google Threat Intelligence has documented as UNC3569's first stage implant since at least 2021, here in an x64 variant. It talks to mail.uaiubifas[.]top over raw TCP on port 443, with every 4096 byte frame encrypted using RC4 and a static six-byte key. Its command set is small and practical: run a process quietly, open an interactive shell, collect system details, upload a file, and load further modules that the operator delivers at runtime.
Update to 16.3.0.3498, then look deeper
Gen reported the flaw to Tencent on April 9, 2026. Tencent acknowledged it the next day and confirmed the fix complete and pushed to users through automatic update on April 21, a twelve day turnaround that Gen explicitly commends. MITRE assigned the CVE on July 10. Anything older than version 16.3.0.3498 should be updated, and on most installs the automatic updater will have done it already.
The fix lives entirely in the link handler. It now recognises the two switches that carry addresses, rejects anything that is not HTTPS, and matches the hostname against a short allowlist. Gen is clear about what that does not touch: the browser engine version and its configuration are unchanged, the sandbox is still off, and the insecure switches are still appended. The front door is locked. The room behind it is the same room.
The indicators from Gen's report, defanged: mail.uaiubifas[.]top for GRAYRABBIT command and control, noht1ng[.]top for the exploit page, and 8.218.50[.]207 for the staging server. Defenders can also hunt for 7z.exe running out of the public documents folder, which is not where anyone installs 7-Zip.
It is worth being precise about what this does and does not establish. Gen documented one exploited chain, at one victim, with one set of infrastructure. It does not put a number on how many machines were reached, and neither does anyone else. Tencent, for its part, characterised the impact as limited, describing the exploitation chain as "relatively complex" and saying it requires "social engineering tactics to induce the user to actively authorize the browser's pop-up prompt", and called on "all platform providers to further strengthen the identification and interception of illicit links". Those two positions are about the same patch and are not flatly contradictory: the path Gen watched being used is closed, and the component it led to has not changed.
The uncomfortable part of this story is not the bug. It is the shape of the software. A typing tool is not a browser, but this one carries a browser, an updater and a private link scheme, and the browser inside it stopped receiving security fixes six years ago while the product around it kept shipping. A mature application quietly hosting an ageing engine that nobody treats as internet facing is not a pattern unique to Sogou, and it is exactly the kind of surface a group that specialises in already-public bugs is good at finding.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.