Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

As cited

Copy frozen at 2026-09-23 21:36 UTC (site build).

vulnerabilities

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Chinese threat actor UTA0565 exploited a chain of vulnerabilities in Google Chrome and Microsoft Windows as zero-days in early September 2026 to deploy CLEANGULP malware via fake websites. The attack leveraged CVE-2026-85046 and CVE-2026-87491 in Chrome together with CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC) to achieve code execution.

Why it matters: Organizations running Windows and Chrome are exposed to active exploitation by a sophisticated Chinese actor using unpatched zero-day chains; patching these CVEs and validating endpoint detection and response (EDR) coverage are immediate priorities.

Source published

2026-09-23 08:29 UTC

First seen by Cybersecurity Tracker

2026-09-23 20:16 UTC