Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese threat actor identified as UTA0565 has been observed exploiting a chained zero-day exploit involving two Google Chrome vulnerabilities (CVE-2026-85046 and CVE-2026-87491) and one Windows Advanced Local Procedure Call vulnerability (CVE-2026-85880). The attacks were detected on September 3 and 4, 2026, and were delivered through fake websites. The exploit chain was used to deploy malware known as CLEANGULP. The combination of browser and OS-level vulnerabilities allowed attackers to break out of sandboxes and escalate privileges. This represents a sophisticated, multi-stage attack campaign attributed to a Chinese state-linked actor.