Chinese Hackers Exploit Critical Tencent Vulnerability for One-Click Code Execution

Post Views: 7

A critical-severity vulnerability in Sogou Input Method has been exploited by a Chinese threat actor to deploy a backdoor, according to Gen Threat Labs.

Vulnerability Overview

The vulnerability, tracked as CVE-2026-51990, allows attackers to achieve system-level code execution through a one-click exploit. Sogou Input Method, developed by Tencent, is a widely used Chinese-language input method editor (IME) for Windows, with hundreds of millions of users.

Exploit Chain Details

The flaw stems from a combination of three security weaknesses that enable a chained exploit. The first issue arises from the protocol handler’s failure to validate or sanitize the ‘param’ parameter during URL parsing. This allows attackers to inject command-line arguments via a crafted URL, triggering a ‘skincenter’ page that is subsequently navigated to by another function.

According to Gen Threat Labs, the second vulnerability involves the browser component within Sogou Input Method, which is based on an outdated Chromium 80 version from March 2020. This iteration lacks six years of security updates, has the sandbox disabled, and removes critical protections such as the same-origin policy.

Patch Information

CVE-2026-51990 was reported to Tencent on April 9. The company addressed the issue in Sogou Input Method version 16.3.0.3498, released via automatic updates. The patch introduced checks for URL-bearing switches in the protocol handler but left the Chromium configuration unchanged.

Implications and Recommendations

The exploit highlights the risks of legacy software components and the importance of timely patching. Threat actors continue to target widely adopted tools to maximize impact, underscoring the need for organizations to monitor and update critical systems.

Threat Actor Background

The China-linked threat group UNC3569 leveraged this exploit chain to deliver malicious sgbiz URLs to victims. Upon clicking these links, attackers gained full system-level code execution. Gen Threat Labs confirmed that the GrayRabbit backdoor was deployed through this method.

Security Measures

Organizations using Sogou Input Method are advised to ensure they are running the latest version and to monitor for signs of compromise, including unexpected network traffic to unknown C&C servers or unauthorized process execution. Security teams should also review their asset inventories to identify and mitigate reliance on outdated software components.

Conclusion

The incident underscores the broader challenge of securing complex software ecosystems, where dependencies on legacy frameworks can create long-standing vulnerabilities. As threat actors increasingly exploit such weaknesses, proactive threat intelligence and continuous monitoring are essential to mitigating risks.