A critical-severity vulnerability in Sogou Input Method has been exploited by a Chinese threat actor to deploy a backdoor, Gen Threat Labs reports.
Developed by Tencent, Sogou Input Method is one of the most popular Chinese-language input method editors (IMEs) for Windows and is used by hundreds of millions of users.
It is a collection of executables that communicate using a custom protocol scheme named sgbiz. When a URL is opened, the protocol handler (biz_helper.exe) parses the URL and dispatches it to the appropriate component.
The critical flaw, tracked as CVE-2026-51990, chained three security weaknesses in a one-click exploit: unvalidated command-line argument injection, unrestricted URL navigation, and an outdated, un-sandboxed Chromium browser engine.
According to Gen Threat Labs, the first issue existed because, during URL parsing, the protocol handler did not sanitize or validate the ‘param’ parameter, which controls the command-line arguments passed to the executable.
This allowed an attacker to inject command-line arguments in the URL to declare a ‘skincenter’ page, which another function would simply copy and navigate the browser to.
The next security hole goes deeper: the browser in Sogou Input Method is based on a Chromium 80 iteration released in March 2020 that is missing roughly six years of security patches, has the sandbox completely disabled, strips additional protections (including same-origin policy), and allows URLs to read other local files.