Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
Chinese actor UTA0565 chains three Chrome and Windows zero-days via fake NGO media sites to drop CLEANGULP backdoor malware on Asian government targets.
92
CVE-2026-85880
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CISA: Microsoft Windows Heap-Based Buffer Overflow Vulnerability
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p33
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
What to do: Apply Microsoft's September 2026 security (cumulative) updates for each affected Windows 10 and Windows Server build, as no public PoC or workaround is documented; CISA's KEV listing (added 2026-09-08) triggers BOD 26-04 patching requirements for federal agencies, so prioritize accordingly. Give priority to hosts where unprivileged users can log in — RDS/VDI servers, jump boxes, shared workstations — and to internet-exposed Windows servers, since an ALPC local privilege escalation is a common component in exploit chains combining remote code execution or browser flaws with elevation to SYSTEM. Organizations unable to patch promptly should follow BOD 26-04 guidance for cloud services or restrict local access to affected hosts until updates are applied.
| Product | Affected |
|---|---|
| Microsoft Windows 10 | 1607, 1809, 21H2, 22H2 |
| Microsoft Windows Server | 2012, 2016, 2019, 2022 |
Estimated exposure
mass≈100M+ Windows installations (Windows 10 1607–22H2 on consumer/enterprise endpoints plus widely deployed Windows Server 2012–2022) — Windows 10 runs on hundreds of millions of devices worldwide with 21H2/22H2 among the most common builds, and Windows Server 2012–2022 remain broadly deployed in enterprise and cloud-hosted estates, so the plausibly affected population is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
KEVCISA Known Exploited Vulnerability
- Affected
- Microsoft Windows
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- microsoft
- Products
- windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows server 2012, windows server 2016, windows server 2019, windows server 2022
- Weakness
- CWE-122, CWE-908
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
20 storiesMicrosoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
90
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
Volexity says China-linked UTA0565 exploited Chrome and Windows zero-days against Asian governments.
88
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.
88
Chinese espionage groups swarm to exploit triple-link chain of zero-days
At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.
88
Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs
Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.
88
Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
88
Microsoft Patch Tuesday Update September 2026 – 974 Vulnerabilities Fixed, Including 2 Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.
88
Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.
86
Microsoft fixes record 964 flaws, including 2 exploited zero-days
Microsoft's September Patch Tuesday fixes a record 964 CVEs, including two actively exploited Windows privilege-escalation zero-days, CVE-2026-81963 and CVE-2026-85880.
86
Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits
Volexity links third Chinese actor UTA0565 to typosquatted phishing sites chaining Chrome and Windows zero-days to deploy CLEANGULP backdoor.
85
One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.
85
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
Volexity attributes spear-phishing campaign exploiting Chrome-Windows zero-day chain to Chinese actors UTA0560 and APT31 deploying GRIMWEDGE and LONGTALE.
85
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
85
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
85
Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.
85
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
85
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Four China-aligned espionage groups, starting with TA412/APT31, chained zero-days CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to spy on targets since late August.
85
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.
85
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.
85