A China-linked group called UNC3569 exploited the Windows operating system via Sogou Input Method, which is the most popular keyboard application for the Chinese language. The intrusion was facilitated by a crafted sgbiz: URL, which opens the attacker’s website using the browser engine (Chromium 80 in 2020 without sandboxing) embedded in the application.
This vulnerability is identified as CVE-2026-51990 and remedied in April with an automatic update from the Tencent corporation. Although the patch prevents the link from working, the patched application includes the same vulnerable, unsandboxed engine.
What is CVE-2026-51990? A remote code execution vulnerability in Tencent’s Sogou Input Method for Windows. This is caused by an unchecked parameter in the sgbiz: link handler and allows navigating in the embedded browser without sandboxing in the Chromium 80 engine. The vulnerability has been patched in version 16.3.0.3498 (April 2026).
A Keyboard App That Carries Its Own Browser
Sogou Input Method for Windows consists of a number of modules, which interact using a proprietary protocol scheme, sgbiz:, registered by Windows. Any application or webpage that launches a link of this type will pass it to the biz_helper.exe protocol handler.
The protocol handler will decide what Sogou module should be launched and does not inspect the command line arguments at all. The URL-decoded arguments are then passed to the module as is.
UNC3569 abused this feature by launching the SGMyInput.exe module (configuration utility) with selected command line arguments that would open the skin store and provide a web address.
Only the skin store module launches a browser window. When an address of this sort is received, the module goes straight to it without checking its scheme and allowing any domains.
The Browser Inside Was Built in 2020
Rendering happens in SGWebRender.exe, built on the Chromium Embedded Framework. The bundled engine identifies itself as Chromium 80.0.3987.163, dating to around March 2020. At the time of analysis it sat roughly 60 major versions behind stable Chrome.
Two protections were disabled in the code itself. The sandbox setting is hardcoded off, so a compromised page runs with the logged-in user’s full rights. Same-origin policy is switched off as well, which lets a page read data from any other origin.
UNC3569’s exploit page, hosted on noht1ng[.]top, carried an exploit for CVE-2021-38003. That V8 flaw, triggered through JSON.stringify, was fixed in Chrome 95 in October 2021. CISA added it to its Known Exploited Vulnerabilities catalog on November 3, 2021. Sogou’s engine never received the fix.
The Link Never Touches Your Browser
| Myth | Reality |
|---|---|
| Updating Chrome protects every Chromium browser on the machine. | Apps built on embedded Chromium frameworks ship their own copy of the engine, updated only when the app vendor updates it. |
| A browser exploit still has to escape the sandbox. | An embedding app decides whether the sandbox is on. The Chromium Embedded Framework exposes it as a setting. |
| A custom link can only open a web page. | Windows hands a registered link scheme to the program that owns it, together with whatever parameters the link carries. |
| An app update fixes the vulnerable component. | A fix can close one path to a component while the component itself stays the same. |
Tencent Disputes the One-Click Claim
The published analysis calls the chain one-click, nothing beyond clicking the link is required. Tencent disagrees. Its response described the chain as relatively complex and said an attacker needs social engineering to get the user to “actively authorize the browser’s pop-up prompt.”
Chromium-based browsers do show a confirmation box before passing a link to an external program. Users can tick a box to stop seeing it for a given site. Neither company has said what victims in this campaign saw, or what appears when such a link arrives by email or chat.
A Legitimate 7-Zip Copy Loaded the Payload
The exploit carried 921 bytes of shellcode acting as a downloader. It fetched three files from 8.218.50[.]207, a staging server on Alibaba Cloud in Hong Kong, and wrote them to C:\Users\Public\Documents\:
7z.exe, a legitimate 7-Zip binary- a trojanized DLL, saved as
7z.dllso 7-Zip would load it from its own folder p, an encrypted blob holding the final payload
The shellcode then ran a meaningless archive command. Its only purpose was to start 7-Zip, which sideloaded the malicious DLL before processing anything.
That loader was built to defeat analysis. It counts running processes and derives its decryption key from the result, so a machine with fewer than 50 processes, typical of a sandbox, decrypts the payload into garbage. Execution goes through the Windows Thread Pool API rather than the commonly hooked CreateThread. Before the payload runs, the DLL moves its data into an NTFS alternate data stream and marks itself for deletion. No delete call ever appears in behavioral logs.
GRAYRABBIT Gives UNC3569 a Foothold
GRAYRABBIT is a lightweight C++ backdoor that UNC3569 has used as a first-stage implant in campaigns since at least 2021. This one is a 64-bit variant, mapped reflectively into memory.
It connects to mail.uaiubifas[.]top on port 443. That traffic is raw TCP encrypted with RC4 under a static key, not TLS. Commands cover silent process execution, an interactive reverse shell, file upload, system profiling and self-termination. A plugin command pulls extra modules from the server and loads them in memory, so operators can extend the implant without replacing it.
UNC3569 is a PRC-nexus group that routinely exploits n-day flaws in widely used software. Its targets include government, education, technology and finance organizations, concentrated in East and Southeast Asia. The group has potential business relationships with i-SOON, the Chinese contractor whose internal communications leaked in 2024. We examined China’s contractor ecosystem in Inside the Knownsec Leak: China’s State-Sponsored Cyber Arsenal Exposed.
The Fix Blocked the Link, Not the Engine
Tencent received the report on April 9, 2026, and confirmed on April 21 that version 16.3.0.3498 had reached all users by automatic update. That is a 12-day turnaround.
The entire fix sits in biz_helper.exe. Only HTTPS addresses are now accepted in the two URL arguments, and only for hostnames ending in sogou.com, qq.com, woa.com or sogou. More checks were added later.
The engine itself was not changed. In the patched build, the sandbox is still disabled, web security is still switched off, and Chromium is still version 80. An outsider can no longer point it at an arbitrary address through the link handler.
The app’s reach is large. Some research suggests that Sogou Input Method has more than 455 million monthly active users across Windows, Android, and iOS, representing approximately 70% of Chinese input method users. No affected version range has been published. Whether updating removes a backdoor that is already running is also unknown.
Every Step Ran Through Trusted Software
Each stage of this intrusion leaned on software that security tools are built to trust. A widely installed input method opened the link. Its own renderer ran the exploit. A genuine 7-Zip binary loaded the DLL, and that loader was designed to defeat sandboxes and scrub its traces from behavioral logs.
Detection tools ask whether activity looks malicious. Almost every process in this chain was legitimate, and the malicious DLL deleted itself before it could be inspected.
Execution Governance asks a different question, is this code trusted? The DLL written to a public documents folder moments earlier had no trust verdict. On Windows endpoints, unknown code runs under Kernel API Virtualization, with file system and registry writes virtualized and network socket creation denied. A backdoor that cannot open a socket cannot reach its command server. Detection keeps its role for visibility and investigation, alongside enforcement that records what unknown code was prevented from doing.
Conclusion: The Fix Closed the Entry Point, Not the Compromise
CVE-2026-51990 shows how trusted desktop software can become an attack path when legacy components and unsafe internal interfaces remain hidden behind a familiar application. UNC3569 abused Sogou Input Method’s sgbiz: handler to reach an outdated, unsandboxed Chromium engine, then used a browser exploit to gain code execution with the logged-in user’s privileges.
From there, the intrusion moved beyond the vulnerable application. The exploit downloaded a legitimate 7-Zip executable, placed a malicious DLL beside it, and used DLL sideloading to launch a loader that attempted to evade sandbox analysis and remove its own traces. GRAYRABBIT then provided remote command execution, file transfer, system profiling, and expandable in-memory functionality.
That sequence creates an important separation between vulnerability remediation and endpoint recovery. Updating Sogou closes the observed entry path, but it does not prove that a system exposed before the update was never compromised.
Why This Threat Matters
- Trusted software can become the exploit surface. The attack began inside a widely deployed legitimate application rather than an obviously malicious executable.
- Old embedded components create hidden exposure. Applications can carry browser engines and libraries that remain vulnerable long after standalone browsers have been updated.
- Signed software does not make every execution path trustworthy. A legitimate 7-Zip binary was used to load an attacker-supplied DLL.
- Post-exploitation behavior was designed to frustrate analysis. Process-count checks, alternate data streams, reflective loading, and uncommon execution APIs reduced obvious telemetry.
- Patching and threat hunting are separate tasks. Closing CVE-2026-51990 does not establish whether GRAYRABBIT or related artifacts executed before remediation.
Where Defensive Control Must Operate
Xcitium Vulnerability Assessment helps identify systems that remain on affected Sogou versions and verify remediation after the vendor fix.
For the execution stage, Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform, addresses suspicious loaders, DLL sideloading, backdoor execution, and follow-on activity. Execution Governance adds the critical trust decision when newly introduced or unknown code attempts to operate through otherwise legitimate software.
Patch the Application. Hunt the Endpoint.
Update Sogou Input Method to the fixed version or later, then investigate previously exposed Windows systems for the observed DLL, loader, GRAYRABBIT artifacts, unusual Sogou child activity, and associated network indicators. The patch closes the known route into the system. Endpoint investigation determines whether an attacker crossed it before that route was closed.
