Hackers Found a Chrome-Windows Flaw Chain Before Anyone Could Patch It

Emily Davis · 2026-09-23

A threat actor tracked as UTA0565 has been quietly weaponizing a chain of Chrome and Windows flaws before most people even knew the bugs existed. The attacks surfaced on September 3 and 4, 2026, and they weren't loud. No ransom notes, no mass defacements. Just fake websites doing the dirty work. If you browse with a standard profile and a fresh install of Windows, this story matters to you more than it might seem. ### What Actually Happened Researchers observed UTA0565 chaining three separate vulnerabilities into one working exploit. Two of them lived inside Google Chrome: - CVE-2026-85046 — a Chrome rendering flaw - CVE-2026-87491 — a second Chrome issue that helped the chain move forward - CVE-2026-85880 — a Windows Advanced Local Procedure Call bug that let the attacker break out of the browser's sandbox Individually, none of these would be enough to hand over your machine. Chained together, they were. That's the part most people miss. A sandbox isn't a wall — it's a series of locked doors, and the attacker only needed one of them to be slightly ajar. ### Why the Browser Sandbox Isn't a Magic Shield Think of Chrome's sandbox like a hotel room with a deadbolt. It keeps you safe from the hallway. But if someone slips a key under the door and then finds a second key to the staff entrance, the deadbolt stops mattering. That's exactly what UTA0565 did. The fake websites were the delivery mechanism. The Chrome bugs were the first key. The Windows ALPC bug was the second. > "Zero-days aren't rare because they're hard to find. They're rare because most attackers don't need them — until they do." Once the chain fired, the payload was CLEANGULP malware, a name that sounds harmless and absolutely isn't. ### What CLEANGULP Does Once It's Inside CLEANGULP is a loader. Its job isn't to cause chaos on day one — it's to sit quietly and wait for instructions. That makes it harder to spot with traditional antivirus, because there's no obvious destructive behavior to flag. Signs that something is off usually show up later: - Unusual outbound traffic from your browser process - New scheduled tasks you didn't create - Browser extensions you don't remember installing - Sudden slowdowns when opening new tabs If any of that sounds familiar, it's worth taking seriously. ### Why This Hits Antidetect Browser Users Harder Here's the uncomfortable part. People running antidetect browsers often juggle dozens of profiles at once — each one logged into a different account, each one carrying real business value. A single compromised profile can unravel an entire operation. The fake-website delivery method is especially nasty for this crowd. Antidetect setups are built to look like real users on real machines. That's the whole point. But it also means a malicious site sees exactly what it wants to see: a normal-looking browser that's worth infecting. A few practical steps that actually help: - Keep Chrome-based engines updated the moment patches drop - Never open profile links from unsolicited messages - Isolate high-value profiles on separate machines or VMs - Rotate proxies and check for unexpected fingerprint drift - Log out of profiles you're not actively using ### The Bigger Picture UTA0565 didn't invent anything new. They just moved faster than the patch cycle. That's the reality of modern browser security — the window between disclosure and exploitation keeps shrinking, and the tools attackers use keep getting cheaper. For anyone running antidetect browsers professionally, the takeaway isn't panic. It's discipline. Patch fast, verify your profiles, and treat every unexpected link like it's carrying something you don't want. Because sometimes it is.