Sogou CVE-2026-51990: your URI handler is attack surface

A Chinese-language keyboard app with hundreds of millions of installs shipped a custom URI handler that took a URL off the command line, passed it into an embedded browser, and navigated there with no scheme check and no domain allowlist. That browser was Chromium 80, roughly six years stale, running without a sandbox. A PRC-linked crew used it to land a backdoor. The specific product does not matter to most readers. The pattern does, because your URI handler is attack surface and a lot of desktop apps ship the same three mistakes.

What actually happened

Gen Threat Labs disclosed CVE-2026-51990 in Sogou Input Method after finding it during a live intrusion. The chain has three links, and each one is boring on its own:

1. The sgbiz: protocol handler routes to biz_helper.exe, which accepts a param argument with, in Gen's words, "no validation at all."
2. The webview in SGMyInput.exe navigates to whatever URL it receives — no scheme check, no domain allowlist.
3. That webview is CEF 80.1.16 with Chromium 80.0.3987.163, sandbox off, six years of public V8 exploits available.

Click a link, get code execution. Gen attributes exploitation to UNC3569, which Google Threat Intelligence ties to the PRC hacker-for-hire scene and has tracked since 2021 across government, education, technology and finance targets in East and Southeast Asia. The payload was GRAYRABBIT, a lightweight C++ backdoor with ten commands: process execution, reverse shell, file transfer both directions, and plugin loading. Gen reported it to Tencent on April 9, 2026; a fix landed by automatic update on April 21 in version 16.3.0.3498, restricting URLs to HTTPS and enforcing a domain allowlist. The CVE was assigned July 10. The Hacker News covered the campaign this week.

Why URI handler security matters for your business

Two angles, depending on which side of the install you are on.

If you ship a desktop app — Electron, Tauri, CEF, anything with a myapp:// handler — you have built the same door. The registered handler is remotely reachable from any web page the user visits. Treat every argument it receives as hostile input from the internet, because that is exactly what it is. Allowlist schemes. Allowlist domains. Never pass a handler argument into a navigation, a shell call, or a file path without validating it first. And pin the version of your embedded runtime to something you actually update — an Electron app frozen at the version you shipped in 2023 is carrying every Chromium CVE published since.

If you just install software, the takeaway is an inventory question nobody runs. On Windows, HKEY_CLASSES_ROOT lists every protocol handler registered on the machine, and most teams have no idea what is in there. Bundled utilities, vendor updaters, conferencing clients, PDF tools — each one may have registered a scheme that turns a link into a local process launch. That is a five-minute check on a reference workstation, and it is the only way you find out what a link on a web page is allowed to start on your endpoints.

The uncomfortable part of this disclosure is the timeline. Patched in April, publicly explained in September. Your exposure window on a bug like this is measured from the vendor's silent auto-update, not from the day you read about it.

Sources: Gen Threat Labs, The Hacker News.