Search: CVE-2026-87491

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

In September 2026, the Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through phishing campaigns targeting Asian government entities. The attacker used fake domains impersonating legitimate organizations to deliver an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Successful exploitation resulted in deployment of CLEANGULP, a previously undocumented malware family with backdoor capabilities including command execution, file operations, and beacon object file execution. CLEANGULP communicated with command-and-control servers using encrypted HTTP traffic with custom encoding. Multiple Chinese APT groups shared access to this exploit kit, indicating coordinated cyber espionage activity during the vulnerability window. Patch status is not yet confirmed; organizations should monitor vendor advisories and apply patches once available.