Chinese State-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A suspected Chinese state-aligned threat group tracked as UTA0565 successfully chained three zero-day vulnerabilities across Google Chrome and Microsoft Windows to breach Asian government networks earlier this month. The attackers bypassed browser security boundaries entirely, using fake non-governmental organization websites to silently install a newly discovered backdoor named CLEANGULP.[1][2]

The exploit sequence functioned like a set of nested keys. When a target visited a malicious site, a hidden iframe triggered a Chrome V8 type-confusion flaw, designated CVE-2026-85046, to execute code within the browser's renderer. A second Chrome vulnerability, CVE-2026-87491, then allowed the attackers to escape the browser sandbox. Finally, the chain abused a Windows Advanced Local Procedure Call defect, CVE-2026-85880, to escalate privileges to the system level.[1][3]

This zero-click infection chain required no user interaction beyond visiting the compromised page. The attacks occurred on September 3 and 4, 2026, while the vulnerabilities remained unpatched in Google Chrome's stable release channel. Because the initial Chrome flaw was patched in the Chromium open-source code repository before the update reached end users, attackers were able to reverse-engineer the fix and weaponize it against organizations that had not yet received the update.[1][2]

Rather than relying on malicious email attachments, UTA0565 lured victims to highly convincing typosquatted domains. The group sent Chinese- and English-language spear-phishing emails urging recipients to support imprisoned Hong Kong activist Chow Hang-tung, who was sentenced to over seven years in prison earlier this year.[1][2]

The emails directed targets to fake websites impersonating legitimate organizations, including the Center for American Progress and China Digital Times. Because the sites loaded genuine content from the real organizations while concealing the exploit code in an invisible iframe, the operation evaded immediate suspicion from the targeted policy analysts and government officials.[1][2]

Once the exploit chain secured system-level access, it deployed CLEANGULP, a previously undocumented malware family written in C and compiled with Microsoft Visual C++. The implant is heavily obfuscated through control-flow flattening and indirect calls, and it establishes persistence by creating a scheduled Windows task named MicrosoftIME.[1][3]

CLEANGULP provides operators with a flexible post-compromise platform capable of executing shell commands, enumerating processes, and transferring files. It communicates with command-and-control servers using AES-256-GCM encryption, connecting to hardcoded typosquatted domains such as 'thecovnresation[.]com', which mimics the academic media network The Conversation.[1]

The most significant aspect of the campaign is the tooling itself. The core exploit framework used by UTA0565 is identical to the kit deployed by other Chinese espionage clusters, including APT31 and UTA0560, earlier in September 2026.[2][3]

This widespread adoption points to a centralized supply chain. "This seemingly widespread adoption across multiple threat actors suggests a coordinated effort within the Chinese CNE community, where the core kit was likely shared, customized, and weaponized by multiple groups," Volexity researchers Damien Cash and Tom Lancaster noted in their analysis. Both Google and Microsoft have since issued patches for the vulnerabilities, shifting the defensive burden to organizations to ensure their browser and operating system fleets are fully updated.[1][2][3]