A recent cybersecurity breach has been identified involving a severe vulnerability in the Sogou Input Method, according to Gen Threat Labs. The flaw, exploited by a Chinese threat group, allowed for the deployment of a backdoor, raising significant security concerns.
Sogou Input Method Vulnerability
Developed by Tencent, the Sogou Input Method serves as a widely-used Chinese-language input method editor for Windows. With a user base numbering in the hundreds of millions, any vulnerabilities in this software could have extensive implications. The software employs a set of executables that communicate via a custom protocol known as sgbiz, which is vulnerable to exploitation.
The vulnerability, designated as CVE-2026-51990, involves a complex exploit that combines three key weaknesses: improper validation of command-line arguments, unrestricted navigation of URLs, and reliance on an outdated Chromium browser engine lacking necessary security features.
Exploitation Methodology
Gen Threat Labs highlighted that the primary issue arises during the URL parsing process, where the protocol handler fails to validate the ‘param’ parameter. This oversight permits attackers to inject command-line arguments, redirecting the system to a malicious ‘skincenter’ page without user knowledge.
Furthermore, the Sogou Input Method’s browser, based on an outdated version of Chromium, exacerbates the risk. This outdated browser lacks six years’ worth of security updates, leaving it vulnerable to multiple threats, including unauthorized local file access.
Implications and Response
The Chinese-linked group UNC3569 has been identified as the exploit’s primary user, utilizing crafted sgbiz URLs to trick victims into executing malicious code. This exploit chain enabled the deployment of the GrayRabbit backdoor, facilitating unauthorized system access and data control.
Gen Threat Labs reported the vulnerability to Tencent on April 9, prompting a fix in the form of an updated Sogou Input Method version 16.3.0.3498. This update addressed the protocol handler issues but did not upgrade the underlying Chromium configuration, leaving some security concerns unresolved.
The persistence of these vulnerabilities underscores the need for continued vigilance and timely software updates to safeguard against similar threats in the future.
