CHINESE HACKERS EXPLOIT CRITICAL TENCENT SOFTWARE FLAW FOR ONE-CLICK CODE EXECUTION

Summary from the TLDR InfoSec newsletter

China-linked UNC3569 used a single crafted link to gain system-level code execution through Sogou Input Method, Tencent's Chinese-language keyboard app used by hundreds of millions of Windows users, and deployed its GrayRabbit backdoor. Gen Threat Labs found that CVE-2026-51990 chained argument injection in the sgbiz protocol handler with a bundled Chromium 80 browser that was six years out of date, ran without a sandbox, and dropped same-origin protections. Tencent patched the injection bug in version 16.3.0.3498, but the outdated Chromium engine behind the chain remained unchanged as of September 10.