Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
Summary: Volexity reported that a third Chinese threat actor it tracks as UTA0565 used chained Chrome zero-days (CVE-2026-85046, CVE-2026-87491) and a Windows local privilege escalation flaw (CVE-2026-85880) on September 3-4, 2026, while the vulnerabilities were still unpatched. The actor delivered the exploits through phishing emails linking to spoofed websites, including a typosquat of the Center for American Progress (americanprgoress[.]top) that loaded a hidden iframe to run the exploit kit and pulled a final payload, chrome_cleanup.exe, belonging to a previously undocumented malware family Volexity calls CLEANGULP.
What's compelling: The same exploit kit has now been seen across multiple Chinese threat actors, leading Volexity to assess the core kit was likely shared and weaponized by several groups - and it notes the activity reported so far reflects only two organizations' observations, with the full scope likely far broader.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-85046CVE-2026-85880CVE-2026-87491
- Related
- Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows Cyber Risks ·CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 08, 2026