CVE-2026-51990

Sogou Input Method, one of China's most widely used keyboard input tools (owned by Tencent), contains a remote code execution flaw in its biz_helper.exe component in versions before 16.3.0.3498. Based on reporting, the flaw is a 'one-click' RCE: an attacker crafts a malicious link that, when clicked by the victim, triggers the vulnerable component to execute attacker-controlled code. Successful exploitation gives the attacker arbitrary code execution in the context of the component, and has been used in the wild to deploy a backdoor tracked as GRAYRABBIT. All users running Sogou Input Method prior to 16.3.0.3498 are potentially affected, with attacks attributed to China-linked threat actors. Exploitation is confirmed in the wild and a public proof-of-concept is available, though the CVE is not yet in CISA KEV and has no CVSS score.

What to do: Update Sogou Input Method to version 16.3.0.3498 or later immediately, prioritizing endpoints used by at-risk users given confirmed in-the-wild exploitation. Investigate hosts for signs of GRAYRABBIT backdoor activity and unusual biz_helper.exe behavior or child process spawns, and warn users against clicking unsolicited links. Since no CVSS score or KEV listing exists yet, treat this as a critical RCE based on active exploitation and the public proof-of-concept on GitHub.