Sogou Input Method biz_helper.exe Protocol Handler Remote Code Execution

CVE-2026-51990 is a remote code execution vulnerability in Tencent's Sogou Input Method for Windows, affecting all versions prior to 16.3.0.3498. The flaw chains three weaknesses: (1) unvalidated command-line argument injection in the sgbiz: custom URI protocol handler (biz_helper.exe), (2) unrestricted URL navigation in a CEF-based webview that accepts any scheme with no domain allowlist, and (3) an embedded Chromium 80 engine (March 2020 vintage) running with sandbox explicitly disabled and same-origin policy turned off. A single click on a crafted sgbiz: link triggers biz_helper.exe → SGMyInput.exe → SGWebRender.exe, which loads an attacker-controlled webpage in the unsandboxed browser. The attacker then exploits CVE-2021-38003 (a V8 type confusion in JSON.stringify) to achieve arbitrary code execution, downloads a legitimate 7-Zip binary alongside a trojanized DLL, and sideloads the GrayRabbit backdoor. Sogou Input Method commands roughly 55% of China's third-party input method market — hundreds of millions of Windows installations.

No vendor CVSS score has been published. Given the 1-click attack surface, the active in-the-wild exploitation by UNC3569 (a PRC-nexus espionage group), and the fact that the patch only addresses the protocol handler without fixing the underlying unsandboxed Chromium engine, this vulnerability warrants a HIGH assessment at 8.0. It falls short of CRITICAL because (a) it requires user interaction (clicking a link), (b) the blast radius is limited to the host where Sogou is installed, (c) the affected software is a desktop IME — not infrastructure — so it does not occupy a high-value role that would trigger the CRITICAL floor, and (d) in Western enterprise environments the installed base is narrow. However, for any organization with Chinese-language workstations, this is an urgent priority.

Sources.

1. Gen Threat Labs — Full Technical Writeup
2. BleepingComputer — GrayRabbit Campaign Coverage
3. SecurityWeek — Chinese Hackers Exploit Tencent Flaw
4. The Hacker News — UNC3569 Sogou Exploitation
5. Security Online — CVE-2026-51990 Exploited in the Wild
6. Security Arsenal — Detection and Remediation Guide
7. Rescana — Targeted Attack Analysis

Run on each Windows host where Sogou may be installed. Execute in an elevated PowerShell session: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-51990.ps1. Requires read access to the filesystem and registry.

# Check-CVE-2026-51990.ps1
# Checks whether Sogou Input Method is installed and vulnerable to CVE-2026-51990
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$found = $false
$vulnVersion = [version]'16.3.0.3498'

# Check common install paths
$sogouPaths = @(
    "$env:ProgramFiles\SogouInput",
    "${env:ProgramFiles(x86)}\SogouInput",
    "$env:LOCALAPPDATA\SogouInput"
)

foreach ($basePath in $sogouPaths) {
    $bizHelper = Get-ChildItem -Path $basePath -Filter 'biz_helper.exe' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
    if ($bizHelper) {
        $found = $true
        $fileVersion = [version]$bizHelper.VersionInfo.FileVersion
        Write-Host "[*] Found Sogou biz_helper.exe at: $($bizHelper.FullName)"
        Write-Host "[*] File version: $fileVersion"
        if ($fileVersion -lt $vulnVersion) {
            Write-Host "[!] VULNERABLE - Version $fileVersion is below patched version $vulnVersion"
            # Also check for sgbiz protocol handler
            $proto = Get-ItemProperty -Path 'Registry::HKEY_CLASSES_ROOT\sgbiz' -ErrorAction SilentlyContinue
            if ($proto) {
                Write-Host "[!] sgbiz: protocol handler is registered - attack surface is active"
            }
            exit 1
        } else {
            Write-Host "[+] PATCHED - Version $fileVersion meets or exceeds $vulnVersion"
            exit 0
        }
    }
}

# Fallback: check registry for sgbiz handler even without finding the binary
$proto = Get-ItemProperty -Path 'Registry::HKEY_CLASSES_ROOT\sgbiz' -ErrorAction SilentlyContinue
if ($proto) {
    Write-Host "[?] sgbiz: protocol handler found but biz_helper.exe not located in standard paths"
    Write-Host "[?] UNKNOWN - manual inspection required"
    exit 2
}

if (-not $found) {
    Write-Host "[+] Sogou Input Method not detected on this host"
    Write-Host "[+] PATCHED (not applicable)"
    exit 0
}