China-linked actor UNC3569 exploited a 1-click vulnerability (CVE-2026-51990) in Sogou Input Method for Windows, affecting software with 455 million monthly users. The flaw stems from custom URI scheme handler sgbiz:, where biz_helper.exe passed unvalidated arguments to SGMyInput.exe. This forced an internal “skin store” window using an embedded Chromium 80 build to load an attacker URL. Because Sogou compiled Chromium with both its sandbox and same-origin protections disabled, weaponized V8 exploits for CVE-2021-38003 achieved immediate arbitrary code execution without requiring a sandbox escape.

The exploit dropped a loader staging DLL side-loading through a legitimate 7-Zip binary in C:\Users\Public\Documents\. The loader verified host processes exceeded 50 to evade automated analysis, self-deleted via NTFS alternate data streams, and deployed the GRAYRABBIT backdoor communicating over TCP port 443 via RC4 obfuscation. Tencent released version 16.3.0.3498 to filter URI arguments in biz_helper.exe, though the legacy Chromium component remains unhardened.

Why it matters:

• Stripped browser isolation weaponizes legacy components: Disabling process sandboxing and origin checks inside custom Chromium forks eliminates multi-stage exploit requirements, enabling 5-year-old V8 browser vulnerabilities to achieve direct OS-level execution through simple URI invocation.
• Protocol handler attack surface and egress monitoring: Organizations must audit registered OS URL schemes, mandate version 16.3.0.3498 across desktop fleets, and flag non-TLS TCP sessions on port 443 alongside unexpected process spawns from public user directories.