> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits - URL: https://f4n6.co.uk/security-feed/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/ - Published: 2026-09-21T21:38:06.000Z - Updated: 2026-09-21T21:38:06.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-85046, CVE-2026-87491, CVE-2026-85880, UTA0565 ## 1\. Executive summary A third China-nexus threat actor, tracked by Volexity as UTA0565, used the same chained zero-day exploit kit as the two actors reported on 9 September 2026: CVE-2026-85046 (CVSS 8.8 HIGH, type confusion in Chrome's V8 engine, in CISA KEV since 2026-09-04), CVE-2026-87491 (CVSS 8.8 HIGH, out-of-bounds write enabling V8 sandbox escape, in CISA KEV since 2026-09-09) and CVE-2026-85880 (CVSS 7.8 HIGH, Windows kernel privilege escalation, in CISA KEV since 2026-09-08). UTA0565 ran its campaigns on 3-4 September 2026, while the vulnerabilities were still unpatched, and differed from the earlier clusters by hosting the exploit kit on multiple spoofed media and civil-society websites rather than abusing an XSS flaw on a legitimate site. The chain delivered a previously undocumented backdoor Volexity names CLEANGULP, which supports shell command execution, process listing, file upload and download, and beacon object file execution, and which beacons over HTTP to a hardcoded typosquat domain. Attribution to UTA0565 is Volexity's tracking designation only; the actor has no MITRE ATT&CK profile, so treat the China-nexus attribution as unconfirmed. All technical detail below is single-sourced to Volexity. ## 2\. Regulatory framing | Article | Trigger | Practical impact | | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Successful exploitation of three CISA-KEV-listed vulnerabilities by a state-nexus espionage actor, with a backdoor granting remote command execution on Windows endpoints, meets the threshold for a major ICT-related incident if confirmed on a client network | If a client confirms CLEANGULP or the exploit chain on any system, the incident classification and reporting clock under Art. 19 must be initiated, not handled as routine malware | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The item supplies specific IOCs (spoofed domains, payload hashes, C2 domain) for a KEV-listed exploit chain, which constitutes a cyber threat requiring classification even absent a confirmed compromise | Clients should classify any detection of the listed domains or hashes under their Art. 18 process and retain the classification decision, including for non-incident detections such as blocked phishing emails | | NIS2 Art. 23: incident reporting obligations | For EU clients in NIS2 scope, the same confirmed-exploitation trigger applies: a KEV-listed chain delivering a command-execution backdoor is a significant incident candidate | NIS2-scoped entities should pre-assess whether a confirmed hit would meet their significant-incident threshold and prepare the 24-hour early warning | No specific UK NIS 2018 obligation is engaged beyond the general OES/RDSP duties, as nothing in this item is specific to UK operators. ## 3\. Technical analysis & attack chain The exploit chain is the same kit documented in Volexity's 9 September report: CVE-2026-85046 gives arbitrary read/write inside the V8 sandbox via a type confusion in the JavaScript engine, CVE-2026-87491 (an out-of-bounds write, per NVD; Volexity describes it as a WebAssembly defect used to escape the V8 sandbox, and both descriptions cover the same escape step) breaks out of V8, and CVE-2026-85880 (heap-based buffer overflow and use of an uninitialized resource) exploits the Windows kernel to escape Chrome's sandboxed renderer and inject code into the browser process. From there the kit executes a payload of the operator's choice. Volexity reports the shellcode was byte-for-byte identical across the UTA0560 and JungleBamboo campaigns, and UTA0565's copy is largely unchanged apart from a replaced post-exploitation payload, renamed variables, debug messages, comments, and an option to log data to an internal IP address. Confirmed attack chain for the UTA0565 campaigns of 3-4 September 2026: 1. Phishing email sent to the target. Two lures are documented: a Chinese-language email to Asian government entities urging public support for imprisoned Hong Kong activist Chow Hang-tung, and an email masquerading as the Center for American Progress. 2. The email links to a spoofed domain registered and controlled by the actor, not to a legitimate site. Observed pairs: chinadigitaltimes\[.\]top spoofing chinadigitaltimes.net, and americanprgoress\[.\]top (a typosquat) spoofing americanprogress.org. 3. The spoofed site loads most of its content from the legitimate website it impersonates, so the page looks real. It also loads a hidden iframe: `