UNC3569 exploited a Sogou Input Method link handler to run code as the user
Gen Digital found the chain while working a live UNC3569 intrusion. Tencent's April 2026 fix closed the link handler and left the bundled Chromium 80 in place, with its sandbox still switched off in the code.
The Watch · Security desk
What happened
- Gen Digital said it found the flaw while investigating a live intrusion by UNC3569, a group Google Threat Intelligence ties to China and places in the country's hacker-for-hire scene.
- The chain ran through sgbiz:, a link type registered on Windows whose handler biz_helper.exe checks which Sogou program a link names but applies no filtering to the arguments it passes on.
- The crafted link started SGMyInput.exe, Sogou's settings program, and told it to open the skin store, the only screen there that opens a browser window, at an address of the attacker's choosing.
- That browser is Sogou's own Chromium 80 build from around March 2020, with the sandbox and the same-origin policy switched off in the code, and the page served an exploit for CVE-2021-38003.
- Tencent fixed the flaw in April 2026, and in the patched version Gen examined the built-in browser engine is still the 2020 version with its sandbox still off.
Why it matters
- What's now possible capability No sandbox escape was needed. A 2021 V8 bug that is worthless against current Chrome is a complete code-execution tool against a host running Sogou Input Method.
- Who's exposed exposure The skin store window still hands the unsandboxed engine any address it is given, so a second route to that window puts an attacker back at execution with the user's privileges.
- Who has to decide decision Anyone running Chinese-language Windows fleets now has to weigh keeping an input method used by 455 million people a month against having a 2020 browser engine on the endpoint.
- What doesn't add up contradiction Gen and Tencent disagree over whether one click sufficed, and because neither disclosed what the victims were shown, any estimate of how much user interaction this chain needs rests on nothing public.
Next story · Security · 10h ago
CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities listConfirmed2 publishers
CVE-2021-38003 was fixed in Chrome 95 in October 2021 [19]. CISA added it to the catalog of vulnerabilities known to have been exploited on November 3, 2021 [20]. The engine inside Sogou Input Method is Chromium 80, built around March 2020 [16], roughly 19 months of Chrome releases before that fix landed [23]. Tencent shipped its fix in April 2026 [2], about 53 months after the KEV listing [24]. Because the engine is Sogou's own compiled copy, updating Chrome on the host does not touch it [21].
Gen says clicking the link was all it took [28]. Tencent, quoted in the research, described the chain as relatively complex and said an attacker would need social engineering to get the user to "actively authorize the browser's pop-up prompt" [29]. Chromium-based browsers do show a confirmation box before handing a link to a separate program on the machine, and a user can tick a box to stop seeing it for a given site [30]. Neither company says what the people in this campaign saw, and Gen says the link could also arrive by email or chat message, where neither account describes what the user is shown [31].
Citizen Lab at the University of Toronto called Sogou the most popular Chinese input method in China in 2023 research [8], and put its user base above 455 million people a month across Windows, Android and iOS, with about 70% of Chinese input-method users [9]. The same research cited market research on visits to the product's website and noted the United States accounted for over 3.3% of them [10]. That percentage counts website visits, not installations, so it yields no figure for a US installed base [22]. Citizen Lab also found encryption flaws in the app that exposed what people typed [11].
Gen's findings cover one product. The research does not address how other input methods or locale-specific desktop utilities are built, or whether organizations carry them in asset inventories [25]. Google has tracked UNC3569 since 2021 against government, education, technology and finance targets, mostly in East and Southeast Asia [4]. GRAYRABBIT, the backdoor placed here, gives an operator a remote command shell, moves files in both directions, and loads additional modules from the attacker's server at any time [6].
What to watch
- Whether Tencent updates the bundled Chromium or enables its sandbox, and in which Sogou version.
- Whether Gen or Google publishes indicators, victim counts, or further UNC3569 intrusions using this delivery path.
- Whether other Sogou components reachable through sgbiz: accept arguments that reach a network-facing feature.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption72
- Hype gap+20
- Incentives40
- Confidence70
Perspective Coverage
3 publishers- Builder
- Builder 40%
- Operator
- Operator 50%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Gen Digital said in research published Thursday that a China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers.
- [2]
Tencent, which owns and develops Sogou, fixed the flaw in April 2026.
- [3]
Gen found the flaw while investigating a live intrusion by UNC3569, a group Google Threat Intelligence ties to China and places in the country's hacker-for-hire scene.
- [4]
Google has tracked UNC3569 since 2021 and says it has targeted government, education, technology, and finance sectors, mostly in East and Southeast Asia.
- [5]
The backdoor installed is GRAYRABBIT, a small program the group has used for years and that Google describes as its first step onto a machine.
- [6]
GRAYRABBIT gives an attacker a remote command shell, allows files to be moved in both directions, and can load additional modules from the attacker's server at any time.
- [7]
Tencent's fix blocked the way in but did not change the part of Sogou that made the attack possible; in the patched version Gen examined, the built-in browser engine is still the 2020 version and its sandbox is still switched off.
- [8]
Sogou Input Method is the most popular Chinese input method in China, according to 2023 research by Citizen Lab at the University of Toronto.
- [9]
Citizen Lab put Sogou's user base at more than 455 million people a month across Windows, Android and iOS, and its share of Chinese input-method users at about 70%.
- [10]
Citing market research on visits to the product's website, Citizen Lab noted that users are not only in China, with the United States accounting for over 3.3% of visits.
- [11]
The same Citizen Lab research found flaws in the app's encryption that exposed what people typed.
- [12]
On Windows, Sogou Input Method is a set of components that communicate via a custom link type registered on Windows, sgbiz:; when anything opens an sgbiz: link, Windows passes it to biz_helper.exe, which reads the link and starts the Sogou component it names.
- [13]
The handler checks which program the link asks it to start but does not check the command-line arguments the link asks it to pass along; Gen found no filtering on them at all.
- [14]
The link pointed at SGMyInput.exe, Sogou's settings program, and told it to open the skin store with a web address of the attacker's choosing.
- [15]
The skin store is the only screen in that program that opens a browser window, and the code sends that browser to whatever address it is handed, with no check on the address at all.
- [16]
Sogou builds its own copy of Chromium, and it is version 80, from around March 2020.
- [17]
Gen found two of the browser's protections switched off and written into the code that way: the sandbox and the same-origin policy.
- [18]
The page the victims were sent to carried an exploit for CVE-2021-38003, a flaw in how V8, Chrome's JavaScript engine, handled JSON.stringify; it let an internal value that scripts should never see escape into the page, and from there an attacker could corrupt memory and run code.
- [19]
Google fixed CVE-2021-38003 in Chrome 95 in October 2021.
- [20]
CISA added CVE-2021-38003 to its catalog of vulnerabilities known to have been exploited on November 3, 2021.
- [21]
Because the browser engine is Sogou's own compiled copy of Chromium, updating Chrome on the endpoint does not change it, and the patched build Gen examined still carried the 2020 engine.
- [22]
The 3.3% United States figure is a share of visits to the product's website, not of installations, so it does not give a United States installed base for Sogou Input Method.
- [23]
Sogou's bundled Chromium 80 build predates the Chrome 95 fix for CVE-2021-38003 by roughly 19 months, so the fix was never present in that engine.
- [24]
About 53 months separate CISA's known-exploited listing of CVE-2021-38003 and Tencent's fix for the Sogou chain.
- [25]
The reported findings are scoped to Sogou Input Method on Windows and contain no statements about how other input methods or locale-specific desktop utilities are built, or about whether organizations inventory them.
- [26]
The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do.
- [27]
With the sandbox gone, a JavaScript flaw in the page becomes code that runs on the user's computer with the user's privileges, and there is no second step to exit the browser.
- [28]
Gen says clicking the link was all it took.
- [29]
Tencent described the chain as relatively complex and said an attacker would need social engineering to get the user to "actively authorize the browser's pop-up prompt."
- [30]
Browsers built on Chromium do show a confirmation box before handing a link to a separate program on the computer, and a user can tick a box to stop seeing it for a given site.
- [31]
Neither company says what the people in this campaign saw; Gen says the link could also arrive by email or chat message, and neither account says what a user sees when a link is opened that way.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers exploit Tencent app flaw to deploy GrayRabbit malware
1 article · September 13, 2026
- securityweek.comChinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution
1 article · September 14, 2026
- thehackernews.comChina-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
2 articles · September 11, 2026
Topics and entities
Topics
- Input method editor security
- China-linked cyber espionage
- Custom URI handler vulnerabilities
- Embedded Browser Engines
Entities
- V8
- Citizen Lab
- Google Threat Intelligence
- Tencent
- Chromium
- Sogou Input Method
- CISA