Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution
A critical-severity vulnerability in Sogou Input Method has been exploited by a Chinese threat actor to deploy a backdoor, Gen Threat Labs reports.
Developed by Tencent, Sogou Input Method is one of the most popular Chinese-language input method editors (IMEs) for Windows and is used by hundreds of millions of users.
It is a collection of executables that communicate using a custom protocol scheme named sgbiz. When a URL is opened, the protocol handler (biz_helper.exe) parses the URL and dispatches it to the appropriate component.
The critical flaw, tracked as CVE-2026-51990, chained three security weaknesses in a one-click exploit: unvalidated command-line argument injection, unrestricted URL navigation, and an outdated, un-sandboxed Chromium browser engine.
According to Gen Threat Labs, the first issue existed because, during URL parsing, the protocol handler did not sanitize or validate the ‘param’ parameter, which controls the command-line arguments passed to...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
