CVE-2026-85046

Reported Context (3)

a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent UTA0565 Used Fake Websites to Deliver Chrome and Windows Zero-Day Exploits
infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity Details Chinese Actors’ Chrome–Windows Exploit Chain Used in Two Espionage Campaigns
targets three vulnerabilities: a type-confusion vulnerability in Chromium’s V8 JavaScript engine (CVE-2026-85046), a V8 sandbox escape (CVE-2026-87491), and a Windows kernel Local Privilege Escalation (LPE) Multiple State-Aligned Threat Actors Rapidly Adopt BlueMoon Chrome and Windows Exploit Chain

CVE (2)

Malware (6)

People (2)

Threat Actors (7)

MITRE ATT&CK (30)

Vendors (3)

Products (11)

Tools (2)

Industries (10)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.