Tencent Sogou IME Flaw Exploited for RCE (CVE-2026-51990)

Executive Summary

A critical vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method Editor (IME) for Windows is being actively exploited by a Chinese threat actor. The software is one of the most popular IMEs in China, with a user base in the hundreds of millions. The vulnerability allows a remote attacker to achieve one-click remote code execution (RCE) and install a backdoor. The exploit, analyzed by Gen Threat Labs, is a sophisticated chain involving a command-line argument injection in a custom protocol handler (sgbiz://), which is then used to force an outdated, embedded Chromium browser to navigate to a malicious site and execute code.

Vulnerability Details

CVE-2026-51990 is not a single flaw but a chain of three distinct weaknesses that, when combined, lead to RCE:

1. Argument Injection via Custom Protocol Handler: The Sogou Input Method registers a custom protocol handler, sgbiz://. The executable that handles these URLs, biz_helper.exe, fails to properly sanitize the command-line arguments passed to it from the URL. This allows an attacker to inject malicious arguments.
2. Unrestricted URL Navigation: The attacker can use the injected arguments to instruct the application to navigate to an arbitrary URL.
3. Outdated, Un-sandboxed Browser Engine: The software uses an old version of the Chromium browser engine that lacks modern security features like a robust sandbox. When forced to navigate to an attacker-controlled webpage, this outdated engine can be exploited to execute arbitrary code on the victim's system.

The attack is initiated when a user clicks a specially crafted link starting with sgbiz://.

Affected Systems

• Product: Sogou Input Method for Windows
• Developer: Tencent
• User Base: Hundreds of millions, primarily Chinese-language speakers.

Specific vulnerable versions were not detailed in the source articles, but users are advised to update to the latest version of the software.

Exploitation Status

The vulnerability is confirmed to be under active exploitation by an unnamed Chinese threat actor. The goal of the observed attacks is to deploy a backdoor on the victim's machine, granting the attacker persistent access and control. The one-click nature of the exploit makes it highly effective for targeted phishing campaigns.

Impact Assessment

The impact of this vulnerability is significant due to the massive user base of the Sogou Input Method. A successful exploit leads to a full compromise of the victim's Windows machine. This could result in:

• Data Theft: Stealing personal files, credentials, and sensitive information.
• Surveillance: The installed backdoor could be used for long-term espionage, monitoring user activity, and capturing keystrokes.
• Botnet Enrollment: Compromised machines could be incorporated into a botnet for use in other malicious activities like DDoS attacks or spam campaigns.

This incident highlights the risks associated with third-party software that uses custom protocol handlers and outdated components, as they can create a large and often overlooked attack surface.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for the following patterns to detect potential exploitation:

Detection & Response

• Process Monitoring: Use an EDR to monitor for the execution of biz_helper.exe and inspect its command-line arguments for suspicious content, such as file paths to malicious scripts or URLs. (D3-PA: Process Analysis)
• Attack Surface Management: Identify all applications in your environment that register custom protocol handlers. This can be done by querying the Windows Registry. Scrutinize these handlers as potential attack vectors.
• Phishing Awareness: Since the exploit requires a user click, detection of phishing emails or messages containing sgbiz:// links is crucial.

Mitigation

1. Update Software: The primary mitigation is to ensure all users have updated their Sogou Input Method to the latest version, which presumably patches these flaws. (M1051: Update Software)
2. Disable Protocol Handler: As a temporary measure, it may be possible to de-register the sgbiz:// protocol handler in the Windows Registry to prevent the exploit chain from initiating. This may impact software functionality.
3. Application Isolation: Use sandboxing technologies to run applications like IMEs in an isolated environment, limiting their ability to execute code or access the file system. (M1048: Application Isolation and Sandboxing)
4. Browser Security: Encourage users to use modern, up-to-date web browsers with robust sandboxing and security features, though this will not protect against the exploit chain that uses the embedded Chromium engine.