https://www.osintinvestigate.com A Chinese-linked threat actor known as UTA0565 has been observed exploiting a Chrome-Windows zero-day chain to deliver CLEANGULP malware. The attacks, detected on September 3 and 4, 2026, combined two Google Chrome vulnerabilities and a Windows ALPC flaw to escape the browser sandbox and achieve remote code execution. The campaign used phishing emails, fake websites, hidden iframes, and impersonated media organizations and NGOs to deceive targeted victims. In this episode, we examine how the BlueMoon exploit chain was used, how CLEANGULP operates, and why the reuse of the same exploit kit across multiple threat actors is attracting attention from cybersecurity researchers.

TL;DR Google released security updates on September 17, 2026, addressing sixteen vulnerabilities in its web browser. These Google Chrome vulnerabilities include two critical flaws that permit memory corruption. Attackers could exploit these weaknesses to execute unauthorized code on victim devices. Users should install the latest browser release immediately to protect their systems. Why It Matters Sourced estimates show that more than three billion people rely on Chrome worldwide.

Google has launched Gemini 3.8 Flash with stronger performance in software engineering, agentic tasks, and multi-step reasoning, while keeping the more permissive Gemini 3.8 Flash Cyber limited to vetted security teams through the Fairwind program. The Cyber version is focused on vulnerability research and patching, with Google and its security partners reporting major gains in correct fixes, faster discovery, and improved prompt-injection robustness. #Gemini #Fairwind #ChromeSecurity #GraySwan

Solo practitioners and small firms should make updating Google Chrome a same-day task. Malwarebytes reports that Chrome’s current desktop update includes 327 security fixes , including 10 critical…

 Security researchers have uncovered three attack techniques that could allow malware on compromised Windows computers to abuse passkeys synchronized through Google Password Manager. The attacks, collectively called “Pass-ta-key,” target Chrome devices equipped with a Trusted Platform Module (TPM). Rather than breaking the cryptography behind passkeys, the techniques exploit weaknesses in device registration, recovery, user verification, and cloud synchronization.  Passkeys are widely considered safer than passwords because they cannot be guessed, reused, or easily stolen through phishing. They normally rely on a device-based cryptographic key and may require a PIN, fingerprint, or facial recognition to approve a login. However, Unit 42 researchers found that malware already running on a victim’s computer could manipulate Chrome’s trusted-device mechanisms without requiring administrator privileges or direct user interaction.  The first technique, Pass-ta-key, abuses Chrome’s TPM-backed device identity key to make Google’s cloud authenticator believe that a request came from the legitimate computer. The service may then return a valid authentication assertion that attackers can use to access a protected account, even without biometric or PIN verification. This attack failed against GitHub because the platform correctly checked the WebAuthn user-verification flag, but it succeeded against eBay before the company fixed the validation issue.  The second method, Silver Pass-ta-key, enables attackers to register their own verification key during a forced Chrome re-registration process. Malware can invalidate the existing verification state or delete local passkey-related data, allowing the attacker-controlled key to be accepted as proof that the device was unlocked by its owner. The most serious technique, Golden Pass-ta-key, attempts to extract Google Password Manager’s Security Domain Secret from Chrome’s memory. This master key encrypts synchronized passkey records, so stealing it could allow attackers to recover private keys and impersonate the victim from another device.  Unit 42 said the stolen secret could potentially decrypt both existing and future passkeys because Google’s current implementation reportedly does not provide a method to rotate or revoke it. The findings highlight that passkeys remain resistant to phishing but cannot fully protect accounts when malware controls a trusted device or browser process. Websites should strictly validate user-verification signals, while credential managers should strengthen device enrollment, recovery, re-registration, and protection of encryption keys in memory. Google was notified of the research, although a complete public response or confirmation of remediation was not immediately available.

CVE-2026-3545 unveils a 13-year-old security flaw in Chrome, exposing significant oversight in vulnerability management despite enhanced AI detection methods.

The threat involves a network of 50 Chrome extensions distributed via the Chrome Web Store, all operating from a single codebase and backend infrastructure, including a shared Firebase project and a hardcoded API key. This setup enables per

Now available for all Windows users, Chrome's security feature will thwart attackers who try to impersonate you by using your stolen browser cookies on their own devices.

DBSC is now live by default in Chrome on Windows, tying your login session cookies to your specific device so stolen cookies become useless to attackers.