Threats Tagged 'cve-2026-85046'

In September 2026, two Chinese threat actors, UTA0560 and JungleBamboo, were observed exploiting an identical Chrome zero-day vulnerability chain targeting NGOs and other organizations. The exploitation leveraged CVE-2026-85046 and CVE-2026-87491 in Chrome alongside CVE-2026-85880 in Windows kernel. These vulnerabilities had been patched in Chromium source code but not yet released to Chrome users, creating a patch-gap exploitation window. UTA0560 conducted spear-phishing campaigns using financial lures to deliver GRIMWEDGE JScript backdoor for reconnaissance and command execution. JungleBamboo employed generic phishing themes to deploy SUPERSTOMP loader, which installed the LONGTALE Chrome extension designed for credential theft, keylogging, and surveillance. Both actors used byte-for-byte identical shellcode, suggesting a shared exploit supply chain while deploying distinct post-exploitation tools tailored to their operational objectives.

HighVulnerabilityUnited States#cve#cve-2026-85046#gemstone

This security update for Chromium addresses multiple critical vulnerabilities across versions 152.0.7977.75 and 152.0.7977.82. The fixes cover a range of issues including use-after-free, type confusion, out-of-bounds reads and writes, improper input validation, incorrect authorization, information leaks, race conditions, and buffer overflows in various components such as V8, WebGL, Skia, CacheStorage, DevTools, and others. These vulnerabilities could potentially allow attackers to execute arbitrary code, escalate privileges, or leak sensitive information. The update also disables the EULA dialog to use preferences instead of a hardcoded return. The affected versions are specifically identified and patches are available in these updated Chromium releases.

Google has fixed multiple vulnerabilities in Google Chrome versions prior to 152.0.7977.82. These vulnerabilities include various types such as use-after-free, out-of-bounds access, and improper input validation, as indicated by associated CWEs. No known exploits in the wild have been reported. The patch status is implied by the fixed version but no explicit vendor advisory or patch links are provided.

A type confusion vulnerability exists in the V8 JavaScript engine used by Google Chrome versions prior to 152.0.7977.82. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.8.