Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A newly observed cyberattack campaign highlights how quickly attackers can turn newly discovered browser and operating-system vulnerabilities into a complete compromise.

The campaign, attributed to a Chinese threat actor tracked as UTA0565, used a chain of three zero-day vulnerabilities affecting Google Chrome and Microsoft Windows. Instead of relying solely on traditional malware attachments, the attackers used carefully designed fake websites and phishing messages to lure targeted users into visiting malicious pages.

Once a victim accessed one of these websites, the attackers exploited vulnerabilities in Chrome to escape the browser's security sandbox and then exploited a Windows vulnerability to achieve remote code execution. The attack ultimately delivered a previously identified malware family known as CLEANGULP.

The activity is particularly concerning because it demonstrates that simply relying on browser sandboxing or endpoint security controls may not be sufficient when multiple vulnerabilities are chained together.

How the Attack Works

The attack follows a relatively simple path from the victim's perspective, but behind the scenes it involves multiple stages:

Phishing/Deception → Malicious Website → Chrome Exploitation → Sandbox Escape → Windows Exploitation → CLEANGULP Malware → Remote Control

The campaign was observed on September 3 and 4, 2026, targeting organizations through convincing phishing messages. Some messages impersonated legitimate organizations and encouraged recipients to visit websites associated with political or social issues. The attackers also created fake websites designed to resemble legitimate organizations.

The malicious pages used an exploit chain involving three vulnerabilities:

- CVE-2026-85046 – a Chrome vulnerability

- CVE-2026-87491 – another Chrome vulnerability

- CVE-2026-85880 – a Windows Advanced Local Procedure Call (ALPC) vulnerability

Why This Matters

The most important lesson from this campaign is the speed and sophistication of exploit chaining.

A browser is often treated as a relatively contained environment because modern browsers use sandboxing to limit what malicious websites can do. However, when attackers possess multiple vulnerabilities, they may be able to bypass these protections and move from the browser into the underlying operating system.

The campaign also demonstrates the continuing importance of patch management. Organizations that delay Chrome or Windows security updates can leave an entry point available even when other security controls are functioning correctly.

Another concern is the apparent reuse of the same exploitation framework across different threat actors. This suggests that advanced exploitation capabilities may be shared, customized and reused rather than remaining exclusive to a single attacker.

Recommended Defensive Actions

• Patch Chrome and Windows: Prioritize updates for affected systems and track vulnerable endpoints.

• Monitor Browser Activity: Detect unusual browser processes, downloads, scripts, and suspicious activity.

• Strengthen Phishing Detection: Monitor and investigate suspicious emails, links, attachments, and phishing indicators.

• Monitor Endpoint Behavior: Detect abnormal processes, command execution, and other signs of exploitation.

• Block Malicious Infrastructure: Use threat intelligence to identify and block known malicious domains, IPs, and URLs.

• Reduce Browser Attack Surface: Apply browser security policies and restrict unnecessary extensions, plugins, and risky configurations.

Keeping these controls effective requires continuous monitoring and timely response. Our threat intelligence, endpoint monitoring, detection, and incident response services help organizations identify and contain suspicious activity across their environments.