Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution
Chinese hackers exploit Tencent's Sogou Input Method flaw for one-click code execution.
A critical vulnerability (CVE-2026-51990) in Tencent's popular Sogou Input Method editor for Windows has been exploited by the Chinese threat actor UNC3569. The exploit chains three weaknesses to achieve one-click remote code execution, allowing the deployment of the GrayRabbit backdoor. The vulnerability was patched in version 16.3.0.3498, but the underlying outdated browser engine remains unaddressed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Tencent?
Get an email when a new story names Tencent, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability in Tencent's Sogou Input Method editor was exploited by the threat actor UNC3569, chaining three weaknesses to achieve one-click remote code execution and deploy the GrayRabbit backdoor. The root cause lies in a failure to fully remediate the underlying outdated browser engine embedded within the software, even after issuing a patch for the immediate CVE. This highlights a common and dangerous pattern where vendors address the symptom (the specific CVE) without resolving the underlying architectural risk (a legacy, unpatched third-party component). Organizations relying on widely deployed software like input method editors — often overlooked in patch cycles — face significant exposure, especially when threat actors actively target these blind spots. Timely patching combined with proactive third-party component auditing is essential to closing these gaps.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-51990
- malware — GrayRabbit