PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-85046] Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

volexity.com | vulnerability | CVE-2026-85046 | #zero-day | #vulnerability-research | #threat-intelligence | #apt | #exploit | #vulnerability | #china | #google-chrome | #uta0565 | #cleangulp
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors. Shortly after that blog post was published, Volexity discovered additional campaigns—this time from a third Chinese threat actor, tracked by Volexity under the alias UTA0565—that used the same chained exploits on September 3-4, 2026, while the vulnerabilities were still unpatched. Notably, this threat actor’s campaigns differed from previously documented attacks by using multiple fake websites to deceive victims.
CVE
CVE-2026-85046
Published
Collected

Related coverage

vulnerability · volexity.com
[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
# Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP October 16, 2026 Volexity Volcano Team Last month, Volexity published two blog posts in its _Mind the (Patch)...
vulnerability · volexity.com
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware.
vulnerability · volexity.com
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or […]
vulnerability · volexity.com
APT Group Wekby Leveraging Adobe Flash Exploit (CVE-2015-5119)
As if the recent breach and subsequent public data dump involving the Italian company Hacking Team wasn’t bad enough, it all gets just a little bit worse. Emerging from the […]
vulnerability · volexity.com
Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence
In the world of information security, there is never a dull moment. Part of the fun of working in this space is that you always get to see attackers do […]
research · volexity.com
Afghan Government Compromise: Browser Beware
Visiting a wide-ranging number of websites associated with the Government of Afghanistan may yield visitors an unwanted surprise. For the second time this year, malicious code has surfaced on, cdn.afghanistan.af, […]
Back