Tencent patches one-click Windows RCE in Sogou Input Method exploited by GrayRabbit backdoor

The vulnerability, CVE-2026-51990, exploited a design flaw in Sogou Input Method’s custom sgbiz: protocol handler. The handler, biz_helper.exe, validated the executable to launch but did not sanitize command-line arguments passed to it. This allowed attackers to supply arbitrary arguments to legitimate Sogou binaries, such as SGMyInput.exe, which were then executed with user privileges. The lack of validation in the param field was the first link in a chain that ultimately led to remote code execution.

The second stage of the exploit involved the skin marketplace feature in SGMyInput.exe. When launched with attacker-controlled arguments, this feature created an unsandboxed Chromium Embedded Framework (CEF) webview. The webview accepted any URL passed via the -url parameter, including HTTP, HTTPS, file, data, and JavaScript schemes, without domain restrictions or HTTPS enforcement. This unrestricted navigation allowed attackers to load malicious content directly into the embedded browser environment.

The final stage leveraged the outdated Chromium 80 engine bundled with Sogou Input Method. The engine, identified as CEF 80.1.16, was approximately six years old at the time of the analysis and lacked modern security protections, including Chromium’s sandbox. This made it a prime target for browser exploits, enabling attackers to execute arbitrary code with the privileges of the current user. The combination of an unsandboxed, outdated browser and unchecked input created a practical one-click RCE vector.

The attack was not a conventional phishing or executable download scenario. Victims only needed to click a malicious link, which then triggered a sequence of legitimate Sogou processes. The initial process tree appeared benign, as it consisted of signed Sogou executables, masking the dangerous transition to an attacker-controlled webview. This stealth aspect made the exploit particularly effective and difficult to detect without deeper inspection of the protocol handler’s behavior.

Tencent patched the vulnerability in April 2026, but the scale of Sogou Input Method’s user base, primarily in China but also among global users of the Chinese-language input method, means residual exposure remains a concern. Engineers should note the risks posed by custom protocol handlers and embedded browsers, particularly when validation is inconsistent or security protections are disabled. Auditing similar components in other applications for unchecked inputs and outdated dependencies is critical to mitigating comparable threats.