Chinese Hackers Exploit Chrome‑Windows Zero‑Day Chain (CVE‑2026‑85046, CVE‑2026‑87491, CVE‑2026‑85880) to Deploy CLEANGULP Malware
What It Is — A Chinese threat group (UTA0565) leveraged a newly disclosed exploit chain that combines two Chrome browser flaws (CVE‑2026‑85046, CVE‑2026‑87491) with a Windows Advanced Local Procedure Call vulnerability (CVE‑2026‑85880). The chain is used to deliver the CLEANGULP malware via malicious web pages.
Exploitability — The vulnerabilities have been observed in the wild (attacks on Sep 3‑4 2026). No public proof‑of‑concept exists beyond the reported campaign, but the active exploitation indicates a high likelihood of successful compromise.
Affected Products — Google Chrome (all supported versions at the time of disclosure) and Microsoft Windows (versions supporting the ALPC component).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring and rapid patch deployment as a core control for maintaining a defensible audit trail.
- Highlights the importance of mapping identified gaps to a unified control framework (VCF) so evidence can be presented across multiple compliance regimes.
- Shows that endpoint detection must be tied to evidence‑collection processes that can be surfaced in a Trust Center for stakeholder assurance.
Recommended Actions
- Inventory all Chrome browsers and Windows endpoints; verify they are running versions patched for CVE‑2026‑85046, CVE‑2026‑87491, and CVE‑2026‑85880.
- Apply the latest security updates from Google and Microsoft immediately.
- Deploy detection signatures for CLEANGULP and monitor logs for anomalous ALPC activity.
- Conduct a focused vulnerability scan on web‑facing assets to ensure no residual exposure.
- Document remediation steps and map the patched controls to your framework of record for audit readiness.
Source: The Hacker News