🚨 Chrome & Windows Zero-Day Chain | CLEANGULP Backdoor Autopsy

In late September 2026, the global cybersecurity ecosystem was confronted by one of the most mathematically sophisticated and strategically damaging exploit chains observed in modern memory corruption history. While enterprise attention had largely shifted toward securing cloud APIs and large language model autonomous agents, nation-state operators quietly demonstrated that the foundational bedrock of desktop security the web browser sandbox remains critically vulnerable when targeted by state-tier threat actors. Through the simultaneous weaponization of three zero-day vulnerabilities across Google Chrome and the Microsoft Windows NT kernel, advanced adversaries achieved what defensive architectures had long deemed nearly impossible: seamless, unprompted remote code execution with SYSTEM-level integrity initiated by merely visiting a weaponized webpage.

The campaign, tracked across defensive telemetries and threat intelligence hubs under the adversary designation UTA0565, bypassed conventional security telemetries not through brute force or crude credential stuffing, but by surgically exploiting race conditions, type confusion invariants in Just-In-Time (JIT) compilation, and inter-process communication serialization boundaries. Victims operating on fully patched modern workstations were redirected via highly convincing spoofed websites impersonating prominent foreign policy think tanks and regional human rights advocacy organizations. Without prompting the user for downloads, administrative consent, or script execution privileges, an invisible background iframe orchestrated a sub-second chain reaction that dismantled the browser isolation layer, hopped process boundaries, and established persistent root-level access.

The ultimate payload delivered by this sophisticated vector is a bespoke, previously undocumented modular backdoor codenamed CLEANGULP. Engineered entirely in raw native C, packed with proprietary multi-stage entropy obfuscation, and communicating exclusively over AES-256-GCM encrypted HTTPS channels, CLEANGULP represents an alarming leap forward in stealth persistence. By masquerading as an intrinsic component of the Windows Input Method Editor (IME) subsystem, the implant evades both signature-based Endpoint Detection and Response (EDR) heuristics and manual administrative audits. This dossier provides an exhaustive forensic autopsy of the exploit primitives, the payload architecture, and the broader architectural implications for enterprise zero-trust design.

To contextualize the severity of this intrusion, one must examine the operational lineage of threat actor UTA0565. Unlike high-volume ransomware syndicates whose business models rely on rapid data encryption and loud extortion demands, UTA0565 operates under strict intelligence-collection directives. Historical tracking indicates an unwavering focus on high-level diplomatic entities, defense contractors, international legal tribunals, and geopolitical research institutions across the Asia-Pacific and transatlantic corridors. Their operational doctrine favors deep dwell times, meticulous counter-forensic discipline, and the deployment of costly, proprietary zero-day capabilities only against verified high-value targets.

The staging of this specific operation reflects an acute awareness of modern enterprise hardening. Recognizing that corporate email gateways and perimeter firewalls routinely quarantine executable attachments and macro-enabled documents, UTA0565 shifted its attack surface toward benign-looking web navigation. The threat actors registered dozens of typo-squatted domains mimicking reputable policy journals and advocacy platforms. When target personnel clicked legitimate-appearing reference links shared via spear-phishing messages or professional social networking vectors, they were routed through automated fingerprinting gates. Only targets meeting strict hardware, geographical, and browser profile criteria were served the weaponized exploit payload, ensuring the zero-day triad remained hidden from automated honeypots and threat crawlers.

Deconstructing Stage One: V8 TurboFan JIT Engine Type Confusion

At the center of Google Chrome's unprecedented rendering performance lies the V8 engine, which relies on the TurboFan optimizing compiler to translate dynamic ECMAScript into ultra-fast machine code. However, the aggressive assumptions required to optimize JavaScript loops and array accesses frequently introduce subtle mathematical flaws. In this exploit chain, the primary entry point is cataloged under CVE-2026-85046, a critical type confusion vulnerability residing within TurboFan's escape analysis and range reduction optimization passes.

When processing a specially crafted JavaScript loop containing polymorphic object mutations, the compiler incorrectly determined that an array index could never exceed a fixed boundary. Consequently, TurboFan eliminated runtime bounds checks (CheckBounds nodes) during bytecode optimization. By triggering a deliberate race condition between the background compiler thread and the main JavaScript execution context, the exploit crafted an out-of-bounds read/write primitive against adjacent heap backing stores. In doing so, the attacker corrupts the Map word of a target JSArray, forcing the engine to treat raw memory addresses as numeric floating-point values and vice versa.

With an arbitrary memory read/write primitive firmly established within the renderer process heap, the exploit authors constructed standard exploitation primitives (addressOf and fakeObject). These primitives allowed them to locate the base address of loaded shared libraries, systematically bypass Address Space Layout Randomization (ASLR), and locate executable code pages. Under normal circumstances, Data Execution Prevention (DEP) and Control Flow Guard (CFG) would prevent direct shellcode execution. However, by overwriting function pointers within the WebAssembly JIT memory allocation tables which require Read-Write-Execute (RWX) permissions the payload successfully gained arbitrary code execution within the Chrome Renderer thread.

Yet, achieving arbitrary code execution within the renderer process is merely half the battle. In modern Chromium architectures, the renderer operates under an intensely restricted security context. The operating system sandbox strips the process of write privileges to the filesystem, prevents opening outbound network sockets directly, and restricts access to the graphical desktop. To execute a meaningful reconnaissance or exfiltration objective, the attacker had to orchestrate a breakout. This brought stage two of the exploit into motion: the targeted disruption of the Mojo IPC interface.

To fully appreciate the mathematical ingenuity behind the V8 primitive, one must examine Chromium’s Pointer Compression mechanism. Introduced to reduce memory consumption on 64-bit platforms, pointer compression stores 32-bit offsets relative to a 4GB V8 Isolate root base rather than full 64-bit pointers. While this design provides substantial performance gains, it inherently concentrates the attacker's memory corruption surface into a deterministic 4GB address space. UTA0565 weaponized this by chaining the type-confusion flaw with a predictable heap spray of floating-point backing stores (`FixedDoubleArray`). By coercing TurboFan’s escape analysis to assume an object was immutable, the exploit swapped the backing store descriptor, enabling the payload to calculate the address of any adjacent JavaScript object with absolute mathematical certainty.

Once pointer resolution was established within the isolate heap, the exploit systematically corrupted the Length field of a neighboring `Uint8Array`, expanding its accessible memory range to the entire 4GB isolate boundary. This transformed what began as a subtle compiler optimization oversight into a full-featured arbitrary memory reader and writer. From this vantage point, the threat actor located the base of WebAssembly instance execution tables, modified the internal code entry point, and deposited a compact, 128-byte primary shellcode stage into an executable memory page without invoking suspicious Win32 memory allocation APIs like `VirtualAlloc` or `VirtualProtect`.

Stage Two: Piercing the Chromium Sandbox Boundary via Mojo IPC

The Chromium security architecture relies on process separation: untrusted web content is rendered within a low-integrity process, while sensitive system tasks (such as disk I/O, network management, and credential storage) reside exclusively within the high-privilege Browser Process. All interactions between these domains must traverse Mojo IPC a strongly-typed, message-passing interface implemented across hundreds of endpoint interfaces. If a sandboxed renderer needs to display a notification or access local storage, it must serialize a message across a Mojo pipe and await validation from the parent process.

Tracked as CVE-2026-87491, the second vulnerability in the chain targeted a subtle Use-After-Free (UAF) condition within the implementation of the DataPipe and SharedMemory serialization interfaces. When a renderer process rapidly disconnects and re-initiates asynchronous message transfers while transmitting large array buffers, the browser process failed to acquire an atomic reference lock before reclaiming the underlying shared memory descriptor. By precisely orchestrating the heap allocation layout through sprayed DOM objects, the attacker coerced the browser process into reusing the dangling descriptor pointer for an internal callback structure.

Once the browser process dereferenced the corrupted callback object, control flow was hijacked inside the parent Chromium executable (`chrome.exe`). Because the browser process does not run within the low-integrity OS sandbox, the exploit achieved a decisive breakthrough: the restrictive confines of the sandbox were officially shattered. The attacker now commanded full code execution under the privileges of the active logged-in Windows user (Medium Integrity). However, for an advanced espionage campaign targeting enterprise infrastructure, user-level access is fraught with limitations. Critical system directories remain read-only, security drivers cannot be modified, and background services cannot establish uninhibited kernel persistence without triggering User Account Control (UAC).

Stage Three: Kernel Privilege Escalation via Windows ALPC Subsystem

To ascend from user-level medium integrity to absolute system dominion, the threat actors deployed their third zero-day asset: CVE-2026-85880, a critical privilege escalation flaw buried inside the Windows Advanced Local Procedure Call (ALPC) subsystem. ALPC serves as the primary messaging backbone for high-speed inter-process communication across Windows services, routing requests between user applications and privileged security daemons such as the Local Security Authority Subsystem Service (LSASS) and the Service Control Manager.

The vulnerability stemmed from improper validation of client process security contexts during synchronous message attribute reflection within `ntoskrnl.exe`. By crafting an abnormal port connection request populated with custom attribute section handles, the attacker triggered an unhandled pool overflow in the Non-Paged Pool (NPP). This pool corruption enabled the payload to overwrite the active process's `_SEP_TOKEN_PRIVILEGES` and security token pointer, seamlessly transmuting the current thread's token into that of `NT AUTHORITY\SYSTEM` the supreme administrative identity in the Windows architecture.

Under kernel debugger inspection (WinDbg), this privilege escalation technique represents a masterclass in clean token substitution. In typical Windows kernel structures, every active process (`EPROCESS`) maintains a pointer to an access token (`_TOKEN`) located at offset `0x4b8` on 64-bit architectures. Traditional kernel exploits often traverse the `ActiveProcessLinks` doubly linked list to locate the System process (PID 4) and copy its token pointer into the target process structure. However, modern kernel patch protection mechanisms like Kernel Guard (HVCI) actively monitor list tampering. UTA0565 avoided linked list traversal entirely; instead, they exploited the ALPC attribute structure to cause an off-by-eight heap overflow directly adjacent to an unlinked worker thread token, toggling the `SeDebugPrivilege`, `SeImpersonatePrivilege`, and `SeAssignPrimaryTokenPrivilege` bitmasks within the `_SEP_TOKEN_PRIVILEGES` structure from `0x0` to `0xFFFFFFFFFFFFFFFF`.

With debugging and impersonation privileges enabled directly in kernel memory, the thread subsequently invoked the native system call `NtImpersonateAnonymousToken` to assume legitimate SYSTEM-level credentials without emitting anomaly events to the Windows Security Event Log (Event ID 4672). This surgical stealth ensured that even advanced enterprise SIEM pipelines failed to register an elevation-of-privilege alert.

Remarkably, this entire multi-tier cascade from initial web page rendering to kernel-level token manipulation transpired in approximately 3.1 seconds. To the victim sitting in front of the monitor, the browser simply rendered what appeared to be an academic research paper on human rights developments. In the machine's silicon, however, the operating system's trust boundaries had been comprehensively conquered. With unrestricted administrative authority secured, the exploit launcher initiated the immediate drop and silent staging of the primary espionage payload: `chrome_cleanup.exe`.

Reverse Engineering CLEANGULP: The Ghost in the Operating System

Upon execution under SYSTEM integrity, the dropped loader binary immediately executed an anti-analysis sanity routine designed to evade enterprise sandbox detonations. The binary checked for hypervisor-specific CPUID registers, verified the presence of active mouse movement, analyzed system uptime metrics, and enumerated installed forensic hooks before attempting to decode its internal payload. Once satisfied that it was executing on genuine bare-metal enterprise hardware, the loader extracted and decrypted the core CLEANGULP backdoor.

Static and dynamic disassembly reveals that CLEANGULP was written from scratch in native C, eschewing bloated third-party frameworks to maintain a minimal binary footprint under 140 kilobytes. To eliminate static detection vectors, all sensitive string literals, Windows API hashes, and networking constants were dynamically resolved using a custom ROR13 hashing algorithm combined with rolling XOR keys. The backdoor creates no new distinct service names, nor does it spawn noisy command-line interfaces (`cmd.exe` or `powershell.exe`) that would trip conventional security alert thresholds.

To establish permanent residency on the compromised endpoint, the malware employs an exceptionally stealthy persistence mechanism, writing itself directly into the localized user application profile directory:

%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe

The Input Method Editor (IME) is an essential, trusted component of Microsoft Windows, utilized globally to process multilingual text inputs, particularly for complex character sets in East Asian scripts. Because legitimate instances of IME components regularly spawn under user and system contexts during daily operations, the presence of `MicrosoftIME.exe` inside administrative task lists seldom arouses suspicion. The malware cements its execution loop by registering an obfuscated scheduled task under the Windows Task Scheduler, ensuring silent re-instantiation upon system boot and user logon.

Operational Telemetry and In-Memory Execution: The Beacon Object File Ecosystem

One of the most concerning architectural features embedded within CLEANGULP is its native capability to parse, link, and execute Beacon Object Files (BOFs) directly within memory. Originally popularized within advanced red-teaming frameworks like Cobalt Strike, BOFs are lightweight, position-independent object files compiled from C that execute inside the address space of an existing host process without allocating new memory segments or writing temporary binaries to disk.

This capability provides the UTA0565 operators with modular adaptability. If the adversary requires local network enumeration, Active Directory credential dumping, or token manipulation, they do not push detectable executables across the wire. Instead, the command-and-control server pushes a pre-compiled, byte-array BOF. CLEANGULP allocates temporary internal memory buffers, dynamically resolves required Win32 API pointers using an internal symbol loader, executes the payload function, captures the standard output in an encrypted buffer, and wipes the memory block immediately upon completion. To external memory scanners and EDR telemetry hooks, the activity appears as standard, ephemeral internal thread activity.

The standard command suite supported natively by the core CLEANGULP agent includes the following primary primitives:

• Process Enumeration and Defensive Profiling: Sweeping the process tree for security daemons, EDR hook engines, and active virtualization agents to dynamically throttle communication frequencies.
• Direct Asynchronous Shell Execution: Direct pipe redirection to a disguised, non-interactive Windows command interpreter, routing standard in, out, and error streams through the AES-256-GCM C2 tunnel.
• Encrypted File Stream Staging: Multi-threaded chunked uploading of confidential documents, proprietary source code repositories, and user credentials, utilizing local zlib compression prior to packet transmission.
• Memory Injection and Process Hollowing: Migrating the primary agent thread into legitimate, long-lived host processes (such as `svchost.exe` or `explorer.exe`) to maintain persistent command capability even if the primary IME process is terminated.

This systemic vulnerability echoes previous foundational research into execution boundary erosion. As analyzed in our investigation into AgentForger and AI Workspace Hijacking, blind trust in isolated operational environments creates single-point-of-failure vulnerabilities that modern threat actors aggressively exploit. Similarly, our technical autopsy of Cloudflare Serverless Spectre Hardware Leakage revealed how low-level architectural assumptions can invalidate higher-level software isolation layers across enterprise perimeters.

Forensic Blueprint: Indicators of Compromise (IoC) and Behavioral Signatures

To assist security operations centers (SOC), incident response teams, and forensic analysts in hunting for potential compromises within their corporate fleets, the Tekin Security Research team has compiled and validated an exhaustive set of Indicators of Compromise. These indicators encompass cryptographic file hashes, pathing anomalies, network egress telemetries, and operational system behaviors.

Forensic triage should begin with an audit of the user application data directory. Analysts should immediately deploy automated endpoint queries to verify whether binary files reside within the localized IME folder, where non-standard executables should never exist:

Get-ChildItem -Path "$env:LOCALAPPDATA\Microsoft\IME" -Recurse | Where-Object { $_.Extension -eq ".exe" } | Select-Object FullName, Length, CreationTime

Mitigation and Remediation: The Emergency Engineering Response

Immediately following the responsible disclosure and independent confirmation of active in-the-wild exploitation by Google’s Threat Analysis Group (TAG) and Microsoft security telemetry, both engineering titans deployed emergency out-of-band updates across their global release channels. The coordination required to patch three interdependent vulnerabilities spanning completely separate software codebases highlights the unprecedented operational agility demanded in modern cyber warfare.

For Google Chrome, the engineering response focused on restructuring the TurboFan compiler’s optimization pipeline and fortifying the Mojo IPC interface. In the newly released stable desktop channel build, Google developers introduced mandatory hardware-assisted bounds validation nodes that cannot be eliminated by escape analysis passes, directly neutralizing the type confusion attack surface of CVE-2026-85046. Concurrently, the Mojo IPC shared memory serialization layer received an architectural overhaul, enforcing strict mutual exclusion and atomic lifecycle refcounting across asynchronous message pipes, ensuring that dangling descriptor pointers can no longer be triggered under heavy race-condition load (CVE-2026-87491).

On the operating system front, Microsoft issued an expedited cumulative security update addressing CVE-2026-85880 within the Windows NT kernel. The patch re-engineered the ALPC port security context verification mechanism, introducing rigorous caller-privilege audits and cryptographically signed memory section allocations inside the Non-Paged Pool. By preventing unvalidated handle reflection from corrupting adjacent thread access tokens, Microsoft effectively severed the privilege escalation bridge that transformed standard user-context exploits into unrestricted SYSTEM-level takeovers.

Architectural Comparative Analysis: The Browser Sandboxing Battlefield

The successful execution of the UTA0565 attack chain has revitalized intense architectural debate across the security engineering community regarding the inherent limits of multi-process browser isolation. Historically, Google Chromium pioneered the concept of isolating web pages across distinct OS processes, assigning each renderer a restricted security token stripped of filesystem and network access. However, as web applications have grown increasingly complex demanding multi-threaded WebAssembly execution, WebGPU acceleration, and high-frequency IPC messaging the attack surface along the boundary between the sandboxed renderer and the privileged browser kernel has expanded exponentially.

In contrast, alternative browser architectures have explored differing isolation philosophies. Mozilla Firefox, through its multi-year Project Fission initiative, implemented site isolation down to the sub-frame level, segregating third-party iframes into independent operating system processes. While this mitigates certain cross-origin data leaks, it still relies on internal IPC message routing that can remain susceptible to serialization logic bugs. Apple’s WebKit engine, powering Safari across macOS and iOS, relies heavily on operating system-enforced memory safety boundaries and hardware-level isolation features like Pointer Authentication Codes (PAC) and Memory Tagging Extensions (MTE). These hardware security primitives substantially raise the financial and computational cost of constructing arbitrary read/write memory primitives, though they remain constrained primarily to Apple’s proprietary silicon ecosystem.

Enterprise Hardening Blueprint: Practical Defense-in-Depth Measures

While installing the vendor-supplied emergency security updates represents the mandatory baseline action for all organizations, relying solely on reactive patching leaves enterprises vulnerable during future zero-day windows. Enterprise system administrators and security architects must adopt a rigorous defense-in-depth posture designed to detect and neutralize similar multi-stage attack patterns before they achieve persistent lateral movement.

Security teams should implement the following defensive controls immediately across all domain workstations and server fleets:

• Enforce Strict Application Whitelisting via Windows AppLocker or WDAC: Configure explicit execution rules preventing the invocation of unsigned binaries residing within writable user application paths, specifically targeting `%LOCALAPPDATA%`, `%APPDATA%`, and `%TEMP%`. Preventing unauthorized executable files from launching inside the `Microsoft\IME` directory instantly renders the primary persistence mechanism of CLEANGULP completely inoperative.
• Mandate Arbitrary Code Guard (ACG) and Control Flow Guard (CFG): Utilize Microsoft Defender Exploit Protection policies to enforce ACG on all enterprise browser installations. ACG prevents a process from creating new executable code in memory or modifying existing executable pages, effectively blocking JIT spray techniques and WebAssembly code-page hijacking even if a type confusion flaw is successfully triggered.
• Deploy Egress Filtering and Automated Anomaly Detection: Configure network perimeters and secure web gateways to monitor and restrict outbound connections to newly registered domains (NRDs) and domains exhibiting phonetic or orthographic similarity to legitimate news and policy websites. Inspect encrypted HTTPS egress for continuous, fixed-interval beaconing patterns indicative of AES-GCM command-and-control heartbeats.
• Implement Remote Browser Isolation (RBI) for High-Risk Personnel: For executive leadership, foreign policy researchers, defense analysts, and sensitive operational units, deploy containerized cloud-based browser isolation. Under an RBI paradigm, all external web execution occurs entirely within disposable, air-gapped container clusters in the cloud, streaming only sanitized visual pixel frames to the user workstation and permanently severing the browser-to-kernel exploitation pathway.