One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.
Volexity reports that China-linked actors UTA0560 and JungleBamboo (APT31/TA412) ran byte-identical Chrome/Windows exploit chains against NGOs starting September 1, 2026, combining Chrome type confusion CVE-2026-85046, WebAssembly sandbox escape CVE-2026-87491, and Windows kernel flaw CVE-2026-85880. The Chrome bug was fixed in Chromium source but not yet shipped to Chrome users, making it an effective zero-day with an unusual patch gap. UTA0560 delivered the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo deployed the SUPERSTOMP loader installing LONGTALE, a malicious Chrome extension disguised as Google Gemini that steals cookies, session tokens, and keystrokes. Volexity assesses with low confidence the exploit chain was sold or shared among different Chinese end-users.
- Identical shellcode across campaigns suggests shared or sold exploit chain.
- Three-CVE chain achieves V8 sandbox escape and Windows kernel code execution.
- Chrome patch gap: fix in Chromium source but unpatched in Chrome during attacks.
- LONGTALE Chrome extension bypasses profile integrity checks via legacy HMAC fallback.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
5 min read at securityaffairs.com
Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, before Chrome’s patch shipped, deploying different backdoors each. Two China-linked threat actors used the same Chrome/Windows zero-day against NGOs starting September 1, 2026, Volexity’s new report lays out the whole chain in detail. On September 1, Volexity detected a spear-phishing campaign by UTA0560 targeting several […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.