Tencent Patched the Sogou Flaw in 12 Days, But Left the Browser Alone

On September 10, 2026, Google Threat Intelligence documented a campaign by the Chinese group UNC3569 that turned Sogou Input Method — the world's most widely used Chinese input method, with roughly 455 million monthly active users — from a productivity utility into an APT infection vector. The attack targeted Windows, not Android or iOS, and installed the GRAYRABBIT backdoor through an exploit chain that starts with a crafted link and ends with arbitrary code execution in the context of the logged-in user. Tencent's response, delivered in 12 days, fixed the immediate issue but left intact a browser engine dating to March 2020.

The Chain That Turns a Link Into a Backdoor

The attack begins with a malformed sgbiz: link. Sogou's biz_helper.exe handles these custom URIs without filtering command-line arguments, allowing arbitrary parameters to be passed to SGMyInput.exe. This component opens the Sogou "skin store" pointing it to an attacker-controlled URL.

Here the second stage triggers. The skin store does not open in the system browser, but in a proprietary window running a build of Chromium 80 dated March 2020. According to Gen Digital analysis, reported by The Hacker News, in this build the sandbox is disabled and the same-origin policy is turned off. This is not a misconfiguration: it is code compiled with those protections removed.

The malicious page exploits CVE-2021-38003, a vulnerability in the V8 JavaScript engine related to JSON.stringify. The bug, patched by Google in October 2021 and added to CISA's KEV catalog on November 3, 2021, allows arbitrary code execution. According to Gen Digital, cited by The Hacker News, "the attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do".

Of the 41 V8 vulnerabilities in the CISA catalog, at least 32 were fixed in Chrome versions released after the 80 used by Sogou. The application therefore remains exposed to a V8 attack surface unpatched for over five years.

GRAYRABBIT: Anti-VM, Side-Loading, and C2 on Port 443 Without TLS

After the V8 exploit, the payload downloads three items to C:\Users\Public\Documents: the legitimate 7z.exe executable, a malicious DLL renamed 7z.dll, and an encrypted file named p. The side-loading exploits automatic DLL loading at 7-Zip startup: the malicious code runs in the context of a trusted application.

The DLL embeds an anti-analysis defense: it counts running processes on the machine. If the count is below 50 — a threshold typical of automated sandbox environments — it generates an incorrect decryption key, rendering the payload undecryptable. Above the threshold, the p file is decrypted and installs the GRAYRABBIT backdoor.

Command-and-control communication occurs at mail.uaiubifas[.]top, port 443. The port is the typical TLS port, but the traffic is plain TCP with RC4 encryption — a protocol that mimics HTTPS traffic without implementing its security.

"The embedded browser engine is still the 2020 version, and its sandbox is still off. What changed is that an outsider can no longer point it at an address of their choosing via the link handler. Gen said those components need more work." — Gen Digital, via The Hacker News

Tencent's Partial Fix: Reactive, Not Structural

Gen Digital disclosed the vulnerability to Tencent on April 9, 2026. The response came in one day; the fix, in version 16.3.0.3498, was released on April 21, 2026 — 12 days from the report. Fast, but incomplete.

The update modifies biz_helper.exe to enforce HTTPS and restrict allowed hostnames to sogou.com, qq.com, woa.com, and sogou. It does not update the browser engine. Chromium 80 with sandbox disabled remains in the code. According to Gen Digital, "what has changed is that an outsider can no longer point it at an address of their choosing via the link handler".

An unresolved divergence exists between Gen Digital's and Tencent's assessments. Gen describes the chain as "relatively complex", but Tencent responded that the attacker would need social engineering to "obtain active user authorization of the browser prompt". The brief does not clarify whether the exploit can work without this interaction.

The brief also does not specify which prior versions were vulnerable, how to verify the installed version on an endpoint, or whether the update removes an already-running backdoor. No data emerges on the number of actual victims.

What to Do Now

• Check for Sogou Input Method on enterprise Windows systems, even outside China: 3.3% of traffic to the Sogou site originates from the United States per the estimate cited by The Hacker News
• Confirm update to version 16.3.0.3498 or later if the software is in use; the brief does not document automated verification methods
• Hunt for indicators of compromise tied to the domain mail.uaiubifas[.]top and files in C:\Users\Public\Documents (7z.exe, 7z.dll, file p)
• Evaluate removal of Sogou Input Method where not required for user productivity, given the persistence of the unpatched browser engine

Why This Incident Redefines the Security Perimeter

The Sogou case is not a vulnerability in a browser everyone knows they have. It is a flaw in software users install to type faster, which quietly bundles an entire web rendering engine with protections disabled. Traditional perimeter logic — patch Chrome, update Edge — does not cover embedded components in seemingly innocuous applications.

Tencent demonstrated response speed but not maintenance depth. The fix filters the entry vector but does not remove the underlying vulnerability: a 2020 browser without sandbox remains executable code on millions of endpoints. For organizations, this means software inventory is no longer enough; they need a map of embedded rendering engines, their lifecycles, and their security configurations.

The brief does not document whether any of the 32+ post-v80 V8 vulnerabilities are reachable through the skin store or other paths. Until Tencent updates the engine, that question remains open — and the residual risk is technical, not hypothetical.

Sources

• https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html
• https://blog.netmanageit.com/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
• https://radar.offseq.com/threat/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware-edc5044d45989d2e
• https://nvd.nist.gov/vuln/detail/CVE-2021-38003
• https://cisa.gov/known-exploited-vulnerabilities-catalog
• https://thehackernews.com/2023/08/encryption-flaws-in-popular-chinese.html

FAQ

CVE-2026-51990 or CVE-2021-38003: Which Is the Sogou Vulnerability?

CVE-2026-51990 is the specific vulnerability in Sogou Input Method's sgbiz: handler. CVE-2021-38003 is the V8 bug exploited in the exploit chain after the browser opens. They are two distinct vulnerabilities in two different components.

Does the Attack Work Even If the User Clicks Nothing?

The brief documents a divergence. Gen Digital does not mention user interaction requirements; Tencent states that "active authorization" of the browser prompt would be needed. The brief does not resolve this discrepancy.

Does Tencent's Fix Provide Complete Protection?

No. The fix restricts the sgbiz: vector but leaves Chromium 80 with sandbox disabled unchanged. According to Gen Digital, "those components need more work".

Information verified against cited sources and current as of publication.

Fonti

• https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html
• https://thehackernews.uk/ai-security-guide-b