Published · 6h agoBuild2 min read
China-aligned UTA0565 chained three zero-days before any of them were patched
Volexity says UTA0565 ran two Chromium JavaScript engine bugs and a Windows privilege-escalation flaw on Sept. 3 and 4, days before any patch, and Proofpoint has tracked the same three across four other groups' campaigns since August.
Written for builders.See today for builders
What happened
- Volexity researchers said the China-aligned group they track as UTA0565 exploited three zero-day vulnerabilities in Chrome and Microsoft products between Sept. 3 and 4, before the defects were disclosed or patched.
- Proofpoint had already attributed attacks involving the same zero-days to APT31, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket, and warned that attackers of other origins and motivations could strike soon.
- Volexity shared phishing emails UTA0565 sent to Asian government entities urging support for imprisoned Hong Kong activist Chow Hang-tung, plus mails from domains spoofing the Center for American Progress and China Digital Times.
- The payload came from a previously undocumented malware family Volexity calls CLEANGULP, and related domains pointed at media organizations, halal restaurant search websites and corporate training organizations.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Exposure to the chain depends on which versions you are running: a patched Chromium build or a patched Windows breaks it whatever the lure looked like. That is why the population Proofpoint could count stayed small.
- decision Teams on next/og now face a runtime decision, because the advisory's own exclusion puts Edge ImageResponse routes outside the affected set.
- precedent Volexity's assessment that the core kit was shared sets the expectation that the same three CVEs show up behind tradecraft that looks nothing alike, so you cannot read which exploit a victim met off the quality of the lure.
Two of the three are remote code execution in the JavaScript engine that Chromium-based browsers share, CVE-2026-85046 and CVE-2026-87491 [3]. The third, CVE-2026-85880, escalates privilege through Windows Advanced Local Procedure Call [4]. That puts two of the chain in the browser and one on the host [1]. A target had to be behind on both products at the same time, and Proofpoint, which has watched state-aligned groups chain the same three since last August, said a limited group of organizations were exposed to all three in a short window [5].
Volexity said UTA0565 used the same components it had seen in earlier instances of the exploit kit across multiple Chinese threat groups [9]. "This seemingly widespread adoption across multiple threat actors suggests a coordinated effort within the Chinese computer network exploitation community, where the core kit was likely shared, customized, and weaponized by multiple groups," the company wrote [7]. It added that the reporting so far covers two organizations' observations and that "the full scope and impact are likely far broader" [8].
Microsoft disclosed the ALPC flaw on Sept. 8, four days after the window Volexity observed [4][2].
The server-side case is narrower and more mundane. Vercel's advisory says the Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability that can lead to remote code execution, and the affected pattern is an application passing attacker-controlled values into SVG content, attributes or styles during image generation [13][14]. Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG, are not affected [15]. Both conditions sit inside your own app. Until the upgrade lands, Vercel's workaround is to remove the second one [16].
The advisory does not report exploitation in the wild. Neither account links next/og to the three CVEs in the UTA0565 chain [3]. The Chromium and Windows chain turns on the patch state of end-user machines [5]. The next/og case is a route you wrote that hands a query parameter to a renderer [14].
What to watch
- Whether Vercel names the upstream component and fixed version, which would tell other Node renderers whether they share the defect.
- Whether either vendor publishes which of the two Chromium engine CVEs handles execution and which handles the escape, showing if both are required.
- Whether a group outside Proofpoint's four, or outside the China-aligned clusters, is reported using the same kit.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Volexity said in a blog post published Monday that a state-aligned Chinese threat group it tracks as UTA0565 exploited a triple-link chain of zero-day vulnerabilities across multiple campaigns.
- [2]
Volexity researchers said UTA0565 exploited the vulnerabilities in Chrome and Microsoft between Sept. 3 and 4, before the defects were disclosed or patched.
- [3]
CVE-2026-85046 and CVE-2026-87491 are remote-code execution defects in the JavaScript engine for Chromium-based browsers.
ReportedView cited source - [4]
CVE-2026-85880 is a privilege-escalation zero-day that Microsoft disclosed Sept. 8 in Windows Advanced Local Procedure Call.
ReportedView cited source - [5]
Proofpoint, which previously observed multiple state-aligned threat groups chaining the vulnerabilities together in attacks since last August, said a limited group of organizations were exposed to all three vulnerabilities in a short window.
- [6]
Proofpoint previously attributed attacks involving the zero-days to APT31, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket, and at the time warned that attackers of other origins and motivations could strike soon as well.
- [7]
Volexity wrote: "This seemingly widespread adoption across multiple threat actors suggests a coordinated effort within the Chinese computer network exploitation community, where the core kit was likely shared, customized, and weaponized by multiple groups."
- [8]
Volexity wrote: "The activity reported so far reflects only two organizations' observations; the full scope and impact are likely far broader."
- [9]
Volexity said UTA0565 used the same components researchers observed in previous instances of the exploit kit across multiple Chinese threat groups, while differing from other attacks by using multiple fake websites to deceive victims.
- [10]
Volexity shared phishing emails UTA0565 sent to Asian government entities urging them to publicly support imprisoned Hong Kong activist Chow Hang-tung, and said the group spoofed domains impersonating the Center for American Progress and China Digital Times in other phishing emails.
- [11]
Volexity said UTA0565 used a payload from a previously undocumented malware family it tracks as "CLEANGULP", and found several domains likely used by the group in similar campaigns targeting media organizations, halal restaurant search websites and corporate training organizations.
- [13]
Vercel's advisory states that the Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability that can lead to remote code execution.
ReportedView cited source - [14]
The advisory says affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation, illustrated by a GET route that reads a URL search param and renders it inside an SVG title element.
ReportedView cited source - [15]
The advisory says applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.
ReportedView cited source - [16]
The advisory's workaround: if upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.
ReportedView cited source - [d1]
The chain totals three CVEs: two remote code execution defects in the Chromium JavaScript engine plus one Windows local privilege-escalation defect.
Derived - [d2]
Microsoft's Sept. 8 disclosure of the ALPC privilege-escalation flaw came four days after the Sept. 4 close of the exploitation window Volexity observed.
Derived - [d3]
The next/og advisory text does not report exploitation in the wild, and neither the advisory nor the Volexity reporting links the next/og bug to the three CVEs in the UTA0565 chain.
Derived
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
Additional citations
- Volexity, via CyberScoop
- Volexity researchers
- Proofpoint
- Volexity blog post
- Volexity