Author: Alexandru-Cristian Bardaș
Published: September 10, 2026
Source: https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou
Summary
Gen Threat Labs disclosed CVE-2026-51990, a critical remote code execution flaw in Sogou Input Method, the Tencent-owned Chinese-language IME installed on hundreds of millions of Windows machines. A single crafted link was enough to reach a six-year-old, sandbox-disabled Chromium engine bundled inside the product and run attacker code on the host. The researchers found the bug while investigating an intrusion by UNC3569, a PRC-nexus group that was already exploiting it in the wild to deploy the GRAYRABBIT backdoor. Tencent was notified on April 9, 2026, confirmed a fix on April 21, 2026, and shipped it through automatic update in version 16.3.0.3498; MITRE assigned the CVE on July 10, 2026. The patch closes the entry point but, per the writeup, leaves the insecure browser configuration itself untouched.
Technical Details
The vulnerability is a chain of three independent weaknesses in how Sogou Input Method talks to its own components. Sogou registers the custom Windows protocol scheme sgbiz:, handled by biz_helper.exe. A URL such as sgbiz:sg_process?module=sgmyinput.exe¶m=-page=skincenter uses its path to select a handler, while query parameters name the executable to launch, its command-line arguments, working directory, and launch mode.
1. Unvalidated argument injection in biz_helper.exe. The module parameter is validated thoroughly — forbidden characters are rejected, MAX_PATH is enforced, the path is resolved relative to the Sogou install directory, and file existence is confirmed. The param parameter, which controls the command line handed to that executable, receives no validation at all: after URL decoding it is passed straight through, unsanitized and unfiltered.
2. Unrestricted URL navigation in SGMyInput.exe. The argument -page=skincenter is the only code path that instantiates a browser, creating a CEF webview for the skin marketplace. Once the view is ready, the code checks for a custom -url argument and navigates to whatever it finds. According to the analysis there is no scheme check — http, https, file, data and javascript are all accepted — no domain allowlist, and no validation of any kind. Normally the webview loads internal Sogou pseudo-domains registered by the application; with a custom URL present, the function simply uses it.
3. An unsandboxed browser engine from 2020. Rendering happens in a separate process, SGWebRender.exe, on Chromium Embedded Framework. The bundled build identifies as CEF 80.1.16 with Chromium 80.0.3987.163, dated March 2020 — roughly six years and 60 major versions behind current stable, and missing hundreds of publicly known CVEs. Its configuration compounds the problem: no_sandbox is set to TRUE in the CefSettings structure, disabling the Chromium sandbox outright, and the process appends switches including disable-web-security (turning off the same-origin policy) and allow-file-access-from-files. The bDisableWebSecurity flag is hardcoded to 1 when SGWebRender.exe initializes the browser manager — not a runtime toggle or a configuration option, but always on.
The chain. A victim clicks an sgbiz: link; Windows routes it to biz_helper.exe, which validates the module but forwards the unvalidated arguments; SGMyInput.exe starts with -page=skincenter and the attacker’s -url; the CEF webview navigates without checks; Chromium 80 loads the attacker page with no sandbox and no same-origin policy; a JavaScript exploit against a known V8 bug executes; and because the sandbox is absent, code execution lands directly at system level.
Exploitation in the wild. UNC3569 — described in the report as a PRC-nexus group that favors operational efficiency and n-day exploitation, targeting government, education, technology and finance sectors worldwide with a concentration in East and Southeast Asia — delivered a link of exactly this form pointing at an exploit page on noht1ng[.]top. The page served JavaScript targeting CVE-2021-38003, a V8 type confusion in JSON.stringify affecting Chrome builds before 95.0.4638.69. The exploit corrupted V8 Map structures to obtain arbitrary heap read/write, located WebAssembly RWX memory, overwrote it with embedded shellcode, and executed it.
The 921-byte x64 shellcode is a downloader: it locates its base with call/pop, walks the PEB to find kernel32.dll via ROR8 hash matching, resolves LoadLibraryW and URLDownloadToFileA, and pulls three files from staging server 8.218.50[.]207 (Alibaba Cloud, Hong Kong) into C:\Users\Public\Documents\: a legitimate 7z.exe, a trojanized loader 7zp.dll (internal name boy.dll), and an encrypted payload p. Renaming 7zp.dll to 7z.dll beside the real binary turns a benign 7z.exe a … archive command into DLL sideloading.
The loader exports the standard 7-Zip symbols as empty stubs; only GetModuleProp carries code. Its anti-sandbox gate snapshots running processes with CreateToolhelp32Snapshot and counts them: at 50 or more processes — a normal workstation — the count is discarded and replaced with zero; below 50 — typical of an analysis sandbox — the real count is kept. That value is XORed into the decryption key alongside a fixed 50,000-iteration floating-point computation and the constant 0x098838B0, so a sandbox silently derives the wrong key and decrypts garbage. Execution is dispatched through CreateThreadpoolWork/SubmitThreadpoolWork rather than the commonly hooked CreateThread. Self-deletion abuses NTFS alternate data streams: the file is opened with DELETE access, renamed via SetFileInformationByHandle/FileRenameInfo into a random ADS, then marked for deletion with FileDispositionInfo — leaving no DeleteFileW call in telemetry.
The payload is a position-independent stub (0xC7 bytes) prepended to a single-byte XOR-encrypted PE — the delivery format documented for GRAYRABBIT since 2021. The stub decrypts 0x42800 bytes with key 0x33, walks the PE export directory, and calls CoreClientInstall. That export is a reflective loader: it resolves VirtualAlloc by PEB-walk hash, allocates RWX memory, maps sections, processes relocations, resolves imports through LdrGetDllHandle/LdrGetProcedureAddress by hash, applies page protections, calls DllMain, then hands off to CoreClientStart.
GRAYRABBIT (internal module name core.dll) reassembles its C2 domain mail.uaiubifas[.]top from a 16-byte XMM constant plus the string op, with port hardcoded to 0x1BB (443). It speaks raw TCP with RC4 encryption using the six-byte static key m5b1u3, reinitializing the S-box for every 0x1000-byte frame; every frame on the wire is exactly 4096 bytes, zero-padded. A receive thread dispatches frames by 4-byte type identifier — 0x6D7367FF (“msg”) for commands and 0x66696C65 (“file”) for file transfer — and C++ RTTI exposes the SRMsg → NormalMsg/FileMsg class hierarchy. Commands 0–9 cover silent process execution, an interactive reverse shell over piped stdio with write and close operations, plugin loading, system-information collection, self-termination, and file upload. Command 5 fetches plugin modules from the C2 through the file-transfer protocol and reflectively loads them, tracking them in a linked list so that unrecognized command IDs are dispatched to plugins via vtable calls — letting an operator extend the implant without replacing it. The system-information beacon reports <ip>+<hostname>+<username>+<exename>:<pid>.
Impact
Affected product: Sogou Input Method for Windows, in versions prior to 16.3.0.3498. The report states the software has hundreds of millions of users but does not enumerate the full range of vulnerable versions beyond the fixed build.
A single click on a crafted sgbiz: link gave an attacker remote code execution at the privilege level of the user running the IME, with no sandbox to contain it and the same-origin policy disabled in the rendering process. Because Sogou Input Method runs continuously as an input method, the attack surface was present on effectively every session. Observed post-exploitation was full backdoor installation: persistence-free but stealthy sideloading, sandbox-aware decryption, self-deleting loader components, an encrypted C2 channel on port 443, interactive shell access, file exfiltration, and modular plugin loading. Gen Threat Labs attributes real-world exploitation to UNC3569 against government, education, technology and finance targets, concentrated in East and Southeast Asia.
Tencent characterized the impact as limited, arguing the chain is relatively complex and requires social engineering to induce the user to authorize the browser’s pop-up prompt, and called on platform providers to strengthen identification and interception of illicit links.
Mitigation
Update to Sogou Input Method 16.3.0.3498 or later. Tencent confirmed the fix on April 21, 2026 and deployed it through the product’s automatic update channel.
The patch is implemented at the protocol-handler level in biz_helper.exe. The handler now identifies URL-bearing switches by name (-url and -firsturl), parses each value with InternetCrackUrlW, rejects anything that is not HTTPS — blocking http://, ftp://, data:// and javascript:// — then lowercases the hostname and checks it against a four-entry suffix allowlist: sogou.com, qq.com, woa.com and sogou. Matching is performed right-to-left against the dotted suffix, so skins.sogou.com passes while attacker-sogou.com does not. Tencent additionally added a module-argument whitelist for browser contexts and a blocklist of dangerous param arguments.
Notably, the researchers report that the CEF configuration and the libcef version were not changed. In the patched SGWebRender.exe and the SGMiniBrowserHelperHost DLL, CefSettings.no_sandbox is still 1, bDisableWebSecurity is still hardcoded to 1, and the command-line callback still appends disable-web-security, allow-file-access-from-files and other insecure switches. The embedded browser remains a sandboxless, security-stripped Chromium 80; it is simply no longer reachable with an attacker-controlled URL through the external protocol handler. Defenders should treat that residual exposure as a reason to prefer input-method alternatives in high-risk environments and to monitor for any other path that reaches the same webview.
Defensive recommendations: hunt for the indicators below; alert on sgbiz: protocol invocations carrying -url arguments to non-Sogou hosts; watch for 7z.exe executing from C:\Users\Public\Documents\ and loading a 7z.dll from that directory; and treat outbound raw-TCP sessions on port 443 that fail TLS negotiation as suspicious. Enterprise environments can also restrict or unregister the sgbiz: URL handler where the IME’s marketplace functionality is not required.
Indicators of compromise (as published, defanged by the source):
- SHA-256
29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63—7zp.dll, trojanized loader - SHA-256
749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e—p, encrypted PE loader shellcode - SHA-256
D7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a— GRAYRABBIT backdoor (core.dll) mail.uaiubifas[.]top— GRAYRABBIT C2 (port 443, raw TCP, RC4)noht1ng[.]top— exploit page hosting8.218.50[.]207— staging server (Alibaba Cloud, Hong Kong)