Executive brief
Sogou Input Method is one of the most widely used Chinese-language keyboard applications with hundreds of millions of installations worldwide. A critical vulnerability allows attackers to silently execute arbitrary code on a victim's computer through a single malicious link, with no user interaction beyond clicking the link required. This vulnerability has been actively exploited by threat actors to deploy backdoors and gain unauthorized access to systems.
Technical details
The vulnerability chains three separate weaknesses in Sogou Input Method: (1) unvalidated command-line argument injection in the sgbiz: custom protocol handler (biz_helper.exe), which fails to sanitize the "param" parameter despite validating the "module" parameter; (2) unrestricted URL navigation in SGMyInput.exe when launched with attacker-controlled arguments; and (3) an outdated, unsandboxed Chromium browser engine that allows remote code execution. The attack vector is network-based: a victim must click a crafted sgbiz: URL embedded in a web page, email, or other internet-accessible content. No authentication is required. An attacker can achieve complete code execution in the context of the current user, enabling backdoor deployment, credential theft, and lateral movement. The vulnerability is fixed in version 16.3.0.3498 and later.
Affected products
- Sogou Input Method before 16.3.0.3498
Timeline
- 2026-09-16: disclosed: CVE-2026-51990 published
- 2026-09-16: patched: Fix available in version 16.3.0.3498
- 2026-09-10: exploited: Actively exploited by UNC3569 threat group to deploy GRAYRABBIT backdoor