Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
Summary: Volexity detected a September 1, 2026 spear-phishing campaign by Chinese threat actor UTA0560 targeting NGO customers, using reflected XSS on a US university website to redirect victims to a chain exploiting Chrome zero-day CVE-2026-85046, a V8 type-confusion bug fixed upstream in Chromium but not yet released in Google Chrome. A second Chinese actor, JungleBamboo (APT31), used the same byte-for-byte identical shellcode chain against different targets, which combined CVE-2026-85046 with a WebAssembly sandbox escape (CVE-2026-87491) and a Windows kernel flaw (CVE-2026-85880) to inject code into the Chrome browser process.
Why it matters: The exploit was patched in Chromium source but not in any released Chrome build, so a known fix upstream left every Chrome user exposed to what was effectively a zero-day, and two separate Chinese actors exploited that gap within days of each other.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-85046CVE-2026-85880CVE-2026-87491
- Related
- Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits Cyber Risks ·CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 08, 2026