CVE-2026-85046: Type confusion in Google Chrome

CVE-2026-85046 is a type confusion vulnerability in Google Chrome that was exploited in early September 2026 by the Chinese threat actor UTA0565. The attacker conducted targeted phishing campaigns impersonating legitimate organizations to deliver an exploit chain leveraging this vulnerability along with others (CVE-2026-87491 and CVE-2026-85880). The exploitation resulted in deployment of CLEANGULP, a previously undocumented malware family capable of command execution, file operations, and beacon object file execution. The malware communicated with its command-and-control infrastructure over encrypted HTTP using custom encoding. The coordinated use of this exploit kit by multiple Chinese APT groups suggests widespread sharing within the Chinese cyber espionage community during the vulnerability window. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code within the context of the browser, leading to full compromise of the affected system. The delivered CLEANGULP malware provides backdoor capabilities including command execution, file operations, and beacon object file execution, enabling persistent access and data exfiltration. The phishing campaigns targeted Asian government entities, indicating potential espionage and sensitive data compromise. The vulnerability is part of a multi-exploit chain used in sophisticated attacks by Chinese APT groups.

Google has published a stable channel update addressing this vulnerability as per their advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html). Users and administrators should apply the official Chrome update promptly to remediate this issue. No additional vendor mitigation guidance is provided. Patch status is confirmed by the vendor advisory as an official fix.