---
id: 10093
title: "[CVE-2026-85046] Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows"
cve: CVE-2026-85046
source_domain: volexity.com
source_url: "https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/"
published_at: "2026-09-09T17:36:22Z"
tags: ["zero-day", "vulnerability-research", "threat-intelligence", "malware", "phishing", "apt", "exploit", "china", "google-chrome", "junglebamboo", "uta0560"]
phying_url: "https://phying.com/item/10093"
lang: en
---

# [CVE-2026-85046] Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

## Summary

On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware.

## Intelligence Metadata

- **Sources:** volexity.com
- **CVE:** CVE-2026-85046
- **Published:** 2026-09-09T17:36:22Z
- **Original:** https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
- **Phying News:** https://phying.com/item/10093