Threats · 35 days ago
UTA0565 broadens Chrome zero-day delivery On day 18, Volexity said a third Chinese actor, UTA0565 , joined the campaign using the same Google Chrome CVE-2026-85046 and CVE-2026-87491 flaws and the Microsoft Windows CVE-2026-85880 flaw, but delivered them through multiple fake websites and phishing emails. The vulnerabilities were still unpatched when UTA0565 used them on September 3-4.
The lure works by sending victims to a spoofed site that looks like a real news or advocacy page, then quietly loading hidden content inside the page. That hidden load triggers the exploit chain, so the attack can land without the victim doing anything more than opening the link.
The shift matters because takedowns aimed at one domain no longer meaningfully end the campaign. If an organization leans on URL filtering or single-site removal, the exposure now sits in a distributed lure set: one fake site can go dark while another keeps the same chain alive.
NVD KEV
Known exploited · CISA KEV
CVSS 8.8 HIGH: type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Microsoft patch: Release Notes.
CISA federal remediation date Sep 18 · date passed
NVD KEV
Known exploited · CISA KEV
CVSS 7.8 HIGH: heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. Microsoft patch: 5122876.
Patch available KB5122876 Download →
CISA federal remediation date Sep 22 · date passed
NVD KEV
Known exploited · CISA KEV
Microsoft patch: Release Notes.
CISA federal remediation date Sep 23
Timeline Sources 16 sources covering this story
BleepingComputer Sep 23
InfraTrust report warns network management systems under attack
Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them.
The Hacker News Sep 23
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.
CyberScoop Sep 22
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups.
Volexity Sep 22
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors.
INCIBE-CERT Sep 15
Múltiples vulnerabilidades en productos de Cisco
Cisco ha publicado 6 vulnerabilidades: 5 de severidad crítica y una de severidad alta que, en caso de
The Hacker News Sep 15
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.
Dark Reading Sep 15
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022.
Rapid7 Sep 11
Metasploit Wrap-Up Goes to Sixteen
Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
BleepingComputer Sep 10
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December.
The Register Security Sep 10
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Mind the patch gap, please and thank you
Proofpoint Sep 9
Four groups caught using the same Chrome and Windows exploit kit
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors.
CyberScoop Sep 9
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Multiple China-aligned threat groups exploited the defects quickly to target various organizations. Proofpoint said the activity is ongoing and expects it to widen.
Entities CVE-2026-85046 CVE-2026-85880 CVE-2026-87491 UTA0565 Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-09
Editions Related stories Threats · 35 days ago
UTA0565 broadens Chrome zero-day delivery On day 18, Volexity said a third Chinese actor, UTA0565 , joined the campaign using the same Google Chrome CVE-2026-85046 and CVE-2026-87491 flaws and the Microsoft Windows CVE-2026-85880 flaw, but delivered them through multiple fake websites and phishing emails. The vulnerabilities were still unpatched when UTA0565 used them on September 3-4.
The lure works by sending victims to a spoofed site that looks like a real news or advocacy page, then quietly loading hidden content inside the page. That hidden load triggers the exploit chain, so the attack can land without the victim doing anything more than opening the link.
The shift matters because takedowns aimed at one domain no longer meaningfully end the campaign. If an organization leans on URL filtering or single-site removal, the exposure now sits in a distributed lure set: one fake site can go dark while another keeps the same chain alive.
NVD KEV
Known exploited · CISA KEV
CVSS 8.8 HIGH: type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Microsoft patch: Release Notes.
CISA federal remediation date Sep 18 · date passed
NVD KEV
Known exploited · CISA KEV
CVSS 7.8 HIGH: heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. Microsoft patch: 5122876.
Patch available KB5122876 Download →
CISA federal remediation date Sep 22 · date passed
NVD KEV
Known exploited · CISA KEV
Microsoft patch: Release Notes.
CISA federal remediation date Sep 23
Timeline Sources 16 sources covering this story
BleepingComputer Sep 23
InfraTrust report warns network management systems under attack
Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them.
The Hacker News Sep 23
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.
CyberScoop Sep 22
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups.
Volexity Sep 22
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors.
INCIBE-CERT Sep 15
Múltiples vulnerabilidades en productos de Cisco
Cisco ha publicado 6 vulnerabilidades: 5 de severidad crítica y una de severidad alta que, en caso de
The Hacker News Sep 15
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.
Dark Reading Sep 15
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022.
Rapid7 Sep 11
Metasploit Wrap-Up Goes to Sixteen
Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
BleepingComputer Sep 10
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December.
The Register Security Sep 10
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Mind the patch gap, please and thank you
Proofpoint Sep 9
Four groups caught using the same Chrome and Windows exploit kit
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors.
CyberScoop Sep 9
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Multiple China-aligned threat groups exploited the defects quickly to target various organizations. Proofpoint said the activity is ongoing and expects it to widen.
Entities CVE-2026-85046 CVE-2026-85880 CVE-2026-87491 UTA0565 Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-09
Editions Related stories