What happened
Chinese threat actor codenamed UTA0565 has exploited a chain of zero-day vulnerabilities affecting Microsoft Windows and Google Chrome. These vulnerabilities, identified as CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880, were exploited through malicious websites. The attacks were detected on September 3 and 4, 2026, and involved chaining two Google Chrome vulnerabilities with a Windows vulnerability in the Advanced Local Procedure Call subsystem. The combined exploitation allowed the attacker to execute arbitrary code on affected systems, resulting in the deployment of the CLEANGULP malware. These types of chained zero-day exploits demonstrate a high level of sophistication, with threat actors capable of bypassing multiple security controls.
Who is affected
Organisations running Microsoft Windows are potentially impacted by this chain of vulnerabilities. Since the vulnerabilities are being actively exploited in the wild, any deployment of affected Windows systems that does not have mitigations in place may be at risk. Specific details on affected configurations or versions are not yet available, but the exploitation method involves the use of malicious websites designed to trigger the vulnerabilities when visited.
Recommended actions
- Ensure that all affected systems are protected against access to malicious and untrusted websites.
- Implement network controls to block traffic to known malicious web resources and domains associated with the exploitation chain, where available.
- Apply security patches once they become available from vendors, and assess the need for additional mitigations or workarounds in the interim.
Indicators of compromise
- Detection of the CLEANGULP malware on affected systems.
- Suspicious network traffic patterns associated with malicious websites linked to the attack chain.
- Unusual or unexpected behaviour in the Windows Advanced Local Procedure Call subsystem.
