A keyboard app with an eight-year-old browser hiding inside it
Sogou Input Method is the input method software used by roughly 70 percent of the Chinese-language keyboard market, with more than 455 million monthly active users. Security firm Gen Digital, investigating an active intrusion by the China-aligned group UNC3569, found that the Windows version of the app embedded a Chromium 80 browser engine, a version released in March 2020 and more than five years out of date, running with its sandbox and same-origin policy protections both disabled.
That combination, an ancient browser engine with its core security protections turned off, sitting inside software installed on hundreds of millions of machines, is the kind of latent risk that rarely makes headlines until someone weaponizes it. UNC3569 did exactly that, building an exploit chain that used the app's own custom link handler to hand a malicious web address directly to that unprotected browser engine, turning a keyboard app into a remote code execution vector.
How the chain actually worked
The attack began with a crafted sgbiz: link, Sogou's custom URI handler, which directed the app's settings program to open what appeared to be a skin store using an attacker-controlled web address. Because the handler failed to properly filter the command-line arguments it passed along, the attacker could redirect that request to a page of their choosing rather than Sogou's legitimate store. That page then leveraged CVE-2021-38003, a known flaw in the V8 JavaScript engine, against the exposed Chromium 80 browser to achieve code execution on the victim's machine.
From there, a downloader retrieved three files from Alibaba Cloud infrastructure hosted in Hong Kong: a legitimate copy of 7-Zip used to unpack the payload, a malicious DLL, and an encrypted payload file. The result was GRAYRABBIT, a 64-bit backdoor giving the attacker a remote command shell, bidirectional file transfer, the ability to load additional modules from attacker-controlled servers, and command-and-control communication over port 443 using RC4-scrambled TCP rather than actual TLS encryption, a detail that makes the traffic distinguishable from legitimate encrypted traffic under close inspection.
Who UNC3569 is and who it targets
UNC3569 is a China-aligned group that Google's Threat Intelligence team has tracked since 2021, operating in what researchers describe as China's hacker-for-hire ecosystem rather than as a direct state employee unit. Gen Digital's own quote on the discovery is unambiguous: the company observed the vulnerability actively exploited in the wild by UNC3569 to deploy the GRAYRABBIT backdoor through a crafted link, meaning this was not theoretical research but a live intrusion caught in progress.
The victim profile spans government, education, technology and finance organizations, concentrated in East and Southeast Asia, which fits a classic espionage targeting pattern rather than opportunistic financial crime. The GRAYRABBIT capability set, remote shell access and arbitrary module loading in particular, supports sustained access and follow-on operations rather than a single smash-and-grab data theft, consistent with an intelligence collection objective rather than a ransomware precursor. That distinction matters for incident response: a GRAYRABBIT infection should trigger a hunt for long-dwell persistence and lateral movement, not just a malware removal and password reset, since the group's evident goal is continued access rather than a quick payout.
The patch fixed the door, not the room behind it
Gen Digital reported the flaw to Tencent on April 9, 2026, and Tencent shipped a fix on April 21 in version 16.3.0.3498, which validates URL arguments and restricts navigation to approved domains, closing the specific entry point UNC3569 used. Judged narrowly, that is a reasonably fast vendor response, twelve days from report to patch, distributed automatically to Sogou's user base without requiring any action from the hundreds of millions of people running the software day to day.
But the patch addresses only the doorway, not the room on the other side of it. Researchers confirmed the underlying Chromium 80 engine remains embedded, unsandboxed and lacking the same-origin policy protections that would normally contain a compromised web page, with at least 32 unpatched V8 engine vulnerabilities from that era still sitting in CISA's own vulnerability catalog. Any future flaw in Sogou's URL handling, or in any other feature that can pass a web address to that embedded browser, reopens the same exploitation path Tencent just spent twelve days closing.
Why this belongs on a CTO's radar outside China
It would be easy for a Western enterprise security team to read this as a regional story and move on, but the data does not support that read. Roughly 3.3 percent of Sogou's website traffic originates from the United States, and any global company with employees, contractors or offices in Greater China, or with Chinese-speaking staff working remotely, has a real chance of encountering this software on a corporate-managed or bring-your-own device connected to company resources.
The broader lesson generalizes well beyond Sogou specifically. Consumer software with hundreds of millions of installs, particularly software from regions with less mature browser-engine patching discipline, routinely bundles outdated web rendering engines for convenience features like theme stores, dictionaries or plugin marketplaces. Asset inventories built around traditional browsers and operating systems miss this category of embedded risk almost entirely, because the vulnerable component never shows up as its own line item in a standard software inventory.
What to check this week
Security teams should extend endpoint detection queries beyond the obvious browsers and check for any consumer application, keyboard software, chat clients, media players, that embeds a Chromium or similar rendering engine, and confirm the embedded engine version rather than trusting the outer application's own version number as a proxy for patch status. Sogou users specifically should confirm they are running 16.3.0.3498 or later, and treat the app's continued presence on any corporate device as worth a deliberate risk conversation rather than a default allow.
Longer term, this incident is a useful prompt to add embedded browser engines to vendor security questionnaires for any consumer or productivity software approved for corporate devices, particularly software originating outside your primary regulatory jurisdiction. A single patched URL handler bought Tencent's users twelve days of safety from one specific exploit chain. It did nothing for the next one that finds a different way to reach the same unprotected browser underneath.
