China-linked hackers exploited Tencent Sogou Input Method flaw CVE-2026-51990 to install GrayRabbit malware

Updated: 2026.09.14 1M ago 2 sources

Malware Zero-Days & CVEs Threat Actors & APTs Urgent Patches

Hackers exploited a critical flaw in Tencent’s Sogou Input Method for Windows to install GrayRabbit backdoor malware on victims’ computers. Gen Digital says UNC3569 used CVE-2026-51990, a one-click remote code execution flaw, by sending a crafted sgbiz: link that abused argument injection, unrestricted webview navigation, and an outdated unsandboxed Chromium 80 engine. Tencent patched Sogou Input Method in version 16.3.0.3498 on April 21, but researchers warned the embedded browser remains outdated and lacks sandboxing.

Why it matters: Sogou Input Method is widely installed, especially in China, so this puts a large number of Windows users at risk of silent compromise after a single click. Users and organizations should update to version 16.3.0.3498 or later immediately and treat unexpected links targeting Sogou’s custom URI handler as suspicious.

Sources

Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution

Ionut Arghire 2026.09.14 98% relevant

This article is the same underlying event: UNC3569 exploited CVE-2026-51990 in Tencent Sogou Input Method to deploy GrayRabbit. It adds plain-language detail on the one-click exploit chain, the insecure sgbiz protocol handler, the outdated unsandboxed Chromium 80 component, the patched version number 16.3.0.3498, and the note that the deeper Chromium configuration remained unchanged as of September 10.

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Bill Toulas 2026.09.13 100% relevant

This article establishes a distinct story by tying active exploitation of CVE-2026-51990 in Tencent’s Sogou Input Method to UNC3569 and GrayRabbit, with vendor patch details and specific attack-chain mechanics.