A dangerous blind spot in how browser security updates reach users gave state-linked hackers a head start this month, according to security researchers, who say multiple China-aligned hacking groups began exploiting the same browser vulnerabilities before fixes ever arrived on ordinary users' machines.
Threat intelligence firm Volexity reported that a Chinese threat actor deployed an exploit chain in early September targeting Google Chrome and Microsoft Windows, ultimately installing previously undocumented malware dubbed CLEANGULP. The firm warned that the core exploit kit behind the attacks appears to be shared across multiple state-sponsored groups — a sign of coordination rather than a lone operation.
The campaign targeted Asian government entities, with phishing emails impersonating a US think tank luring victims to spoofed media and NGO websites. Researchers concluded that simply visiting the malicious sites was enough to compromise a vulnerable system.
What the researchers found
According to the reporting, the attackers combined vulnerabilities in Chrome with a Windows flaw to break out of the browser's sandbox and take full control of victims' systems. The phishing lures were carefully chosen: emails masquerading as messages from a prominent think tank directed targets to fake websites designed to look like trusted media outlets and non-governmental organisations.
The malware installed on compromised machines was built to maintain quiet, persistent access and communicate with attacker-controlled infrastructure disguised to resemble a legitimate media domain — a classic technique for blending malicious traffic into normal web activity.
Volexity assessed that the exploit kit at the heart of the campaign is being actively shared across several China-linked groups, suggesting the tooling has been distributed, customised and weaponised by multiple teams operating in concert.
The patch gap problem
The most consequential finding, however, concerns timing. Reporting by Cybernews reconstructed the timeline: a security researcher privately reported a severe Chrome vulnerability to Google in early August, and the fix was published to the browser's public open-source code repository days later. But the patch did not reach Chrome users in the stable release until early September — nearly a month during which the fix was visible to anyone watching, including attackers.
Experts described the window as an unusual patch gap. Because the vulnerability was fixed upstream but unpatched in the shipping browser, it functioned as a zero-day against Chrome users for weeks. Attackers armed with AI-assisted code analysis could study the public fix, understand the flaw, and build working exploits before most users were protected.
Google has since moved Chrome to a two-week release cycle, down from four weeks — a change first announced in March that shortens the exposure window. But researchers caution that it narrows rather than eliminates the problem: as long as fixes are public before they are delivered, a gap remains.
Shared toolkits raise the stakes
The involvement of at least four China-aligned groups using the same exploit kit marks a shift in how state-sponsored tooling spreads. Rather than each group developing its own capabilities, a shared, weaponised toolkit lets multiple teams strike simultaneously — and makes attribution and defence harder, since the same techniques appear across different operations.
For defenders, the implication is sobering: a single publicised patch can now arm several adversaries at once. The period between a fix appearing in public code and reaching users is no longer a quiet administrative window — it is an active attack surface.
What defenders should do
The clearest defence is speed. Organisations and individuals should enable automatic browser updates and keep operating systems patched, treating browser updates with the same urgency as server patches. Security teams should assume that publicly fixed vulnerabilities are being exploited and prioritise patching accordingly.
Beyond patching, the campaign is a reminder to treat unsolicited emails from advocacy groups and think tanks with caution, verify unexpected links before opening them, and ensure endpoint protection is in place. For high-risk users — government staff, journalists, activists — keeping browsers current is one of the simplest and most effective protections available.
Why it matters for Pakistan
Chrome is the dominant browser in Pakistan, and phishing campaigns impersonating trusted organisations regularly target Pakistani government officials, journalists and civil society. A patch gap measured in weeks means that delaying a browser update can leave users exposed to state-grade attacks.
The lesson for Pakistani organisations is straightforward: enable automatic updates on all devices, keep them on, and treat a pending browser update as an open door. In an environment where exploit kits are shared across threat groups, the defenders who patch fastest are the hardest to hit.
