CVE-2026-85046

A Chinese threat actor, UTA0565, exploited a zero-day chain involving vulnerabilities in Google Chrome and Microsoft Windows to deploy a new malware family named CLEANGULP. The attacks, observed on September 3 and 4, 2026, used fake websites mimicking media organizations and NGOs to deliver the BlueMoon exploit kit, which leveraged CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to escape the browser sandbox and execute code remotely. The malware, delivered as 'chrome_cleanup.exe', communicates with a hard-coded C2 domain and provides capabilities including command execution, process listing, file upload/download, and beacon object file execution.

Multiple threat actors are exploiting a new vulnerability chain involving flaws in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) to deploy an undocumented exploit kit called BlueMoon. The campaigns, primarily attributed to China-aligned groups, have targeted fewer than 20 organizations globally. Separately, a zero-click worm dubbed WeWorm exploits a vulnerability in WeChat (patched in August 2026) to hijack accounts and spread via incoming calls on Android and iOS without user interaction, requiring only that the attacker be on the victim's friends list. Additionally, hackers are deploying a fileless Linux rootkit on compromised F5 BIG-IP APM devices, leveraging CVE-2025-53521 to inject a web shell into memory via PHP eval() calls, tracked by ESET as PoisonedRefresh.

A Chinese threat actor tracked as UTA0560 conducted a spear-phishing campaign targeting NGOs by exploiting a zero-day chain in Google Chrome and Microsoft Windows. The attack abused CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to bypass sandbox protections and execute arbitrary code, ultimately deploying a JavaScript-based backdoor named GRIMWEDGE. This backdoor enables host reconnaissance, command execution, file operations, and payload delivery through a C2 server. A second China-linked group, JungleBamboo (APT31), used the same exploit chain to deploy the SUPERSTOMP loader and the LONGTALE credential-stealing Chrome extension.

A new exploit kit named 'BlueMoon' has been observed in the wild, leveraging chained zero-day vulnerabilities in Google Chrome and Microsoft Windows to achieve remote code execution and privilege escalation. The kit has been used by multiple cyber-espionage groups, including JungleBamboo (APT31) and UTA0560, in targeted attacks against NGOs, aerospace, defense, and manufacturing sectors. BlueMoon exploits three specific flaws: two in Chrome's V8 engine and one in Windows ALPC, enabling sandbox escape and local privilege escalation. The attacks are delivered via spearphishing, with payloads including malware loaders and in-memory backdoors such as Grimwedge and ShadowPad.

Multiple espionage-motivated threat actors, including APT31 and several China-aligned clusters, have leveraged a previously undocumented exploit kit named BlueMoon to exploit unpatched vulnerabilities in Google Chrome and Microsoft Windows. The exploit chain combines CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to achieve sandbox escape and local privilege escalation, delivered via phishing emails leading to malicious URLs. The kit downloads payloads such as the GemStone browser backdoor, ShadowPad, and Rust-based malware using DLL sideloading and in-memory execution techniques. The U.S. CISA has added all three CVEs to its KEV catalog, mandating federal agencies to patch them by mid-September 2026.

Google has patched a new Chrome zero-day vulnerability, CVE-2026-87491, which has been actively exploited in the wild. The vulnerability is a high-severity out-of-bounds write issue in the V8 JavaScript and WebAssembly engine, allowing remote attackers to execute arbitrary code within the browser sandbox by luring users to malicious HTML pages. Exploitation can lead to heap corruption, data exposure, or browser crashes. Google has not disclosed further details about the ongoing attacks to avoid exposing technical details before most users are patched.

A zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, tracked as CVE-2026-87491, is being actively exploited in the wild. The flaw is an out-of-bounds write that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Google has patched the vulnerability in Chrome versions 153.0.8010.36 and later, but has not disclosed specific details about the exploitation or the threat actor involved, likely to prevent further abuse before widespread patching.

Multiple active threats were reported this week, including a Chrome zero-day under active exploitation (CVE-2026-85046), which allows remote code execution via a crafted HTML page. MikroTik RouterOS devices are being targeted using an exploit chain called MikroTrick, combining CVE-2026-67276 and CVE-2026-86060 to achieve unauthenticated remote code execution. Unpatched Magento and Adobe Commerce stores are being compromised via a zero-day named StyleSmuggler, leading to backdoor installation. A supply chain attack on Coder's infrastructure delivered malicious Terraform modules that steal credentials. Additionally, the RevStealer information stealer is spreading via fake game cheats and a counterfeit Claude desktop app, using blockchain-based dead drops for resilience.