Google Chrome (Organization): news timeline & CVEs

New Browser Guard features add protection before and after you click

Malwarebytes Browser Guard adds Search Reputation ratings and on-device LLM-powered Scam Guard Lite to block scams before and after clicking.

Malwarebytes announced two new features for its Browser Guard extension: Search Reputation, which labels Google, DuckDuckGo, Brave, and Bing search results as Good or Malicious, and Scam Guard Lite for Chrome. Scam Guard Lite downloads Google's Gemini model to the device and analyzes webpage content locally with an LLM, without sending browsing history to the cloud. The features extend existing protections against scams, malware, ads, and trackers; the full Scam Guard remains part of Malwarebytes Premium Security.

Malwarebytes LabsSep 24, 12:45 UTC · 2d agoTools

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Chinese actor UTA0565 chains three Chrome and Windows zero-days via fake NGO media sites to drop CLEANGULP backdoor malware on Asian government targets.

Volexity detected attacks on September 3-4, 2026 in which UTA0565 chained Chrome flaws CVE-2026-85046 and CVE-2026-87491 with Windows ALPC bug CVE-2026-85880 to escape the browser sandbox and gain remote code execution. Phishing emails impersonating the Center for American Progress and themed around Hong Kong activist Chow Hang-tung targeted Asian government entities, luring victims to spoofed domains loading the BlueMoon exploit kit via hidden iframe. The final shellcode dropped CLEANGULP, an MSVC-built implant with shell, process listing, upload, download, and BOF execution capabilities, using thecovnresation[.]com for HTTP command-and-control. Volexity believes the shared exploit kit reflects coordinated use across multiple Chinese CNE groups with broader impact than currently observed.

The Hacker NewsSep 23, 08:29 UTC · 4d agoExploit / PoC in the wild 4 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-85880

Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits

Volexity links third Chinese actor UTA0565 to typosquatted phishing sites chaining Chrome and Windows zero-days to deploy CLEANGULP backdoor.

Volexity attributes a third Chinese-linked espionage cluster, UTA0565, to September 2026 phishing operations against Asian government entities using cloned sites like chinadigitaltimes[.]top. Hidden iframes chained Chrome V8 type confusion CVE-2026-85046 (a patch-gap flaw fixed in Chromium source but not yet in stable Chrome), V8 sandbox escape CVE-2026-87491, and Windows kernel LPE CVE-2026-85880 for full code execution. The final payload, CLEANGULP, is an 893 KB obfuscated C backdoor persisting as MicrosoftIME.exe via a scheduled task, with shell, file transfer, process enumeration, and BOF commands over AES-256-GCM encrypted HTTP C2. Proofpoint reports the shared BlueMoon exploit framework has at least four espionage users with a suspected China nexus, indicating rapid spread of the capability.

GBHackersupdated Sep 23, 08:29 UTC · 4d agofirst Sep 22, 09:01 UTC · 5d agoThreat actor in the wild 4 sources CVE-2026-85046

Google Chrome

Timeline3 articles

Related CVEsby mentions

Appears with

New Browser Guard features add protection before and after you click

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits