CVE-2026-85046MalwarePublished 09/23/2026Updated 10/23/2026

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

Affects Google Chromium V8Source AlienVault OTX General

Severity

Unrated

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 09/04/2026
KEV deadline: 09/18/2026
EPSS: 48.9% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

In September 2026, the Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows via phishing campaigns targeting Asian government entities. The attacker used fake domains impersonating legitimate organizations to deliver an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attacks deployed CLEANGULP, a previously undocumented malware family with backdoor capabilities such as command execution, file operations, and beacon object file execution. The malware communicated with command-and-control servers using encrypted HTTP traffic with custom encoding. Multiple Chinese APT groups shared access to this exploit kit, indicating coordinated use within the Chinese cyber espionage community during the vulnerability window.

Summary

This threat involves a coordinated exploitation campaign by the Chinese threat actor UTA0565 in early September 2026, targeting unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows. The attacker registered spoofed domains mimicking reputable organizations and sent targeted phishing emails to Asian government entities. The exploit chain leverages three zero-day CVEs: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Successful exploitation results in the deployment of CLEANGULP, a novel malware family with backdoor functionalities including command execution, file manipulation, and beacon object file execution. CLEANGULP communicates with its command-and-control infrastructure via encrypted HTTP traffic using custom encoding schemes. The presence of multiple Chinese APT groups with access to this exploit kit suggests widespread sharing and coordinated cyber espionage activity during the period these vulnerabilities remained unpatched.

Impact

The exploitation of these zero-day vulnerabilities enables attackers to deliver CLEANGULP malware, which provides backdoor access to compromised systems. This includes capabilities for remote command execution, file operations, and persistent beaconing to command-and-control servers. The campaign targeted Asian government entities, potentially compromising sensitive information and enabling espionage activities. The coordinated sharing of the exploit kit among multiple Chinese APT groups indicates a significant threat to targeted organizations during the vulnerability window.

Defensive guidance

Patch status is not yet confirmed — check the vendor advisories for Google Chrome and Microsoft Windows for current remediation guidance. Until official patches are available, organizations should be aware of phishing campaigns using spoofed domains impersonating legitimate organizations and block or monitor access to the identified malicious domains. Employing email filtering and user awareness training focused on phishing risks related to these campaigns is recommended. Since the vulnerabilities are zero-day, timely application of vendor patches once released is critical.

Weaknesses

CWE-843Type Confusion (opens in a new tab)

Indicators of compromise

Domains 8

halal-navi.net
outsourcingwise.net
halaltak.net
personclouds.com
americanprgoress.top
chinadigitaltimes.top
thecovnresation.net
thecovnresation.com

CVEs 3

CVE-2026-85046
CVE-2026-85880
CVE-2026-87491

URLs 1

https://americanprgoress.top/chrome_cleanup.exe

Hashes 4

177652713dad3c128bd9195abf2b7603
668aa5551315ab26b67118fbb29f8e4560a1e1af
8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb
cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21