[CVE-2026-85046] Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
volexity.com | vulnerability | CVE-2026-85046 | #zero-day | #vulnerability-research | #threat-intelligence | #malware | #phishing | #apt | #exploit | #china | #google-chrome | #junglebamboo | #uta0560
Summary
On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware.
- CVE
- CVE-2026-85046
- Published
- Collected
--- id: 10093 title: "[CVE-2026-85046] Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows" cve: CVE-2026-85046 source_domain: volexity.com source_url: "https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/" published_at: "2026-09-09T17:36:22Z" tags: ["zero-day", "vulnerability-research", "threat-intelligence", "malware", "phishing", "apt", "exploit", "china", "google-chrome", "junglebamboo", "uta0560"] phying_url: "https://phying.com/item/10093" lang: en --- # [CVE-2026-85046] Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows ## Summary On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware. ## Intelligence Metadata - **Sources:** volexity.com - **CVE:** CVE-2026-85046 - **Published:** 2026-09-09T17:36:22Z - **Original:** https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/ - **Phying News:** https://phying.com/item/10093