Sogou Input Method update restricts links after GrayRabbit attack claims

Restricting where custom links can navigate

BleepingComputer reports that researchers observed UNC3569 exploiting CVE-2026-51990, a one-click remote-code-execution flaw in Tencent’s Sogou Input Method for Windows, to install the GrayRabbit backdoor. Remote code execution means an attacker can cause software on another device to run code. The report says the attack used a crafted custom link to pass attacker-controlled arguments into the application, then load a malicious web page through its embedded, outdated Chromium browser. It also says Tencent’s version 16.3.0.3498 changed the link-handling controls, although researchers warned that the underlying browser remained outdated and unsandboxed.

Before the reported update, Sogou Input Method’s protocol handler accepted URL arguments without validation and its embedded browser could navigate to unrestricted destinations.

According to the report, Tencent released Sogou Input Method version 16.3.0.3498 with URL-argument validation, HTTPS-only links, and navigation limited to approved Sogou and Tencent domains after the flaw was linked to GrayRabbit deployment.

The reported fix changes the application’s handling of custom links at several points in an alleged active attack chain, while the researchers’ warning leaves a separate concern about the embedded browser’s security posture.