Sogou Input Method sgbiz: Protocol Handler Argument Injection Leading to RCE via Unsandboxed Chromium 80

CVE-2026-51990 is a remote code execution vulnerability in Sogou Input Method for Windows, affecting all versions prior to 16.3.0.3498. The flaw chains three weaknesses: (1) unvalidated argument injection in the sgbiz: custom protocol handler (biz_helper.exe), (2) unrestricted URL navigation in the CEF-based webview (SGMyInput.exe), and (3) a fatally outdated, unsandboxed Chromium 80 engine (from March 2020) with same-origin policy disabled. A single crafted sgbiz: link gives an attacker full code execution on the victim's machine with no interaction beyond the initial click. Sogou commands ~55% of the Chinese IME market with hundreds of millions of installations.

Neither NVD nor Tencent has published a CVSS score. Tencent downplayed the chain as 'relatively complex' requiring 'social engineering to induce the user to actively authorize,' but this characterization is misleading. The exploit requires exactly one click on a link — no dialog authorization, no file download prompt in many configurations. UNC3569, a China-linked hacker-for-hire group tracked by Google Threat Intelligence since 2021, actively exploited this vulnerability in the wild to deploy the GRAYRABBIT backdoor against government, education, technology, and finance targets in East and Southeast Asia. The embedded Chromium 80 carried at least 32 of the 41 V8 vulnerabilities in CISA's KEV catalog — any one of them could serve as the in-browser exploit stage. noisgate assesses this as HIGH, not CRITICAL, because the attack surface is client-side workstations requiring social engineering, not a remotely exploitable server or identity-tier component.

Why this verdict

• Active APT exploitation confirmed: UNC3569 weaponized this chain with a stable V8 exploit (CVE-2021-38003) and deployed GRAYRABBIT, a mature C2 backdoor with reverse shell, file transfer, and plugin loading. This is not a PoC — it is an operational capability.
• Trivial exploitation mechanics: The sgbiz: URL is a one-liner to construct. The Chromium 80 engine carries 32+ KEV-listed vulnerabilities, any of which can substitute as the browser exploit stage. The sandbox is disabled, eliminating the hardest part of browser exploitation.
• Massive installed base: ~500M+ installations worldwide with dominant market share in China. Even a small fraction of enterprise deployments creates significant exposure.
• Role multiplier: Sogou IME is installed on end-user workstations — category (a) low-value role in isolation. However, in government and enterprise environments in East/Southeast Asia, it runs on endpoints that may include privileged admin workstations, developer machines with CI/CD access, and finance department hosts with sensitive data access. The blast radius per compromised host is user-level (not SYSTEM), but the initial access it provides feeds directly into lateral movement chains. This keeps the verdict at HIGH rather than elevating to CRITICAL.
• Incomplete patch: The fix only adds URL allowlisting in biz_helper.exe. The unsandboxed Chromium 80 engine and disabled security controls remain — future bypasses of the allowlist would re-expose the full chain.

Why not higher?

The vulnerability requires social engineering — the victim must click a crafted link. It is client-side workstation software, not a server, identity provider, hypervisor, or network edge device. Code execution runs at user privilege level, not SYSTEM. The blast radius is per-host, not fleet-scale, and there is no direct domain escalation path inherent to the vulnerability itself. These factors collectively prevent a CRITICAL assessment despite the confirmed exploitation.

Why not lower?

Confirmed active exploitation by a state-linked APT with a deployed backdoor immediately rules out MEDIUM or below. The one-click attack with no additional interaction, the trivially constructable exploit URL, the massive installed base, and the availability of 32+ substitute browser exploits in the unsandboxed Chromium 80 engine all reinforce that this is a serious, weaponized threat requiring urgent action.

1. Block or uninstall Sogou Input Method enterprise-wide — If Sogou IME is not a business requirement, remove it from all managed endpoints immediately. Use SCCM, Intune, or your endpoint management platform to enforce removal. This eliminates the attack surface entirely. For a HIGH verdict, deploy within 30 days per noisgate mitigation SLA — but given active exploitation, move faster if your user population includes East/Southeast Asian operations.
2. Block sgbiz: protocol handler via registry policy — Deploy a GPO or Intune configuration to delete or disable the HKCR\sgbiz registry key on all managed Windows endpoints. This breaks the initial entry point of the chain without requiring Sogou removal. Test first — this may break legitimate Sogou skin/plugin functionality.
3. Push Sogou auto-update and verify version 16.3.0.3498+ — If Sogou must remain installed, verify all instances are updated to 16.3.0.3498 or later. Sogou's auto-updater should have deployed this in April 2026, but enterprise proxy/firewall configurations may block the update channel. Manually verify via file version of biz_helper.exe.
4. Add GRAYRABBIT IOCs to EDR and network monitoring — Import SHA-256 hashes (29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63, d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a), C2 domain mail.uaiubifas[.]top, staging IP 8.218.50[.]207, and exploit domain noht1ng[.]top into your threat intel platform and EDR blocklists immediately.
5. Monitor for anomalous SGMyInput.exe child processes — Create EDR detection rules for SGMyInput.exe spawning cmd.exe, powershell.exe, or writing files to C:\Users\Public\Documents\. This detects both known and variant exploitation of the CEF webview.

Run on each Windows endpoint where Sogou may be installed, with standard user privileges. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-51990.ps1

# Check-CVE-2026-51990.ps1
# Checks whether Sogou Input Method is installed and vulnerable to CVE-2026-51990
# Requires: standard user privileges
# Output: VULNERABLE / PATCHED / UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$patchedVersion = [version]'16.3.0.3498'
$found = $false
$result = 'UNKNOWN'

# Check common Sogou install paths
$searchPaths = @(
    "$env:ProgramFiles\SogouInput",
    "${env:ProgramFiles(x86)}\SogouInput",
    "$env:LOCALAPPDATA\SogouInput",
    "$env:APPDATA\SogouInput"
)

foreach ($basePath in $searchPaths) {
    if (Test-Path $basePath) {
        $bizHelper = Get-ChildItem -Path $basePath -Recurse -Filter 'biz_helper.exe' -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($bizHelper) {
            $found = $true
            $fileVersion = [version]$bizHelper.VersionInfo.FileVersion
            Write-Host "Found biz_helper.exe at: $($bizHelper.FullName)"
            Write-Host "File version: $fileVersion"
            if ($fileVersion -ge $patchedVersion) {
                $result = 'PATCHED'
            } else {
                $result = 'VULNERABLE'
            }
            break
        }
    }
}

# Also check registry for sgbiz protocol handler
$sgbizKey = Get-ItemProperty -Path 'Registry::HKEY_CLASSES_ROOT\sgbiz\shell\open\command' -ErrorAction SilentlyContinue
if ($sgbizKey -and -not $found) {
    $found = $true
    Write-Host "sgbiz: protocol handler registered: $($sgbizKey.'(default)')"
    $result = 'VULNERABLE'
    Write-Host 'WARNING: sgbiz: handler is registered but biz_helper.exe was not found in standard paths.'
}

if (-not $found) {
    Write-Host 'Sogou Input Method does not appear to be installed.'
    $result = 'PATCHED'
}

Write-Host "`nRESULT: $result"
if ($result -eq 'VULNERABLE') { exit 1 }
elseif ($result -eq 'PATCHED') { exit 0 }
else { exit 2 }

Sources

1. Gen Threat Labs — Gray Rabbits and the Tale of a One-Click Backdoor
2. The Hacker News — China-Linked UNC3569 Exploited Sogou Input Method Flaw
3. CISA Vulnerability Summary — Week of June 8, 2026
4. Statista — China Third-Party Input Method Market Share
5. CISA Known Exploited Vulnerabilities Catalog
6. NuclearCoffee — UNC3569 Sogou Exploitation Coverage
7. GuardianMSSP — UNC3569 Sogou Advisory