China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.
- UTA0560 and JungleBamboo (APT31) hosted byte-identical exploit shellcode but deployed different espionage payloads.
- Chain abused CVE-2026-85046 (V8), CVE-2026-87491 (WebAssembly escape), and CVE-2026-85880 (Windows kernel privilege escalation).
- Links on legitimate U.S. university sites vulnerable to reflected XSS redirected victims to attacker landing pages.
- Payloads were GRIMWEDGE JScript backdoor for UTA0560 and LONGTALE keystroke-capturing Chrome extension for JungleBamboo.
- Volexity assesses medium confidence a shared exploit developer sold the chain to separate Chinese operators.
- ATT&CK
- T1566.002 Spearphishing LinkT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege EscalationT1574.002 DLL Side-LoadingT1176 Browser Extensions
- Products
- ChromeChromiumGoogle Gemini
- Threat actors
- UTA0560JungleBambooAPT31Violet TyphoonTA412
- Malware
- GRIMWEDGELONGTALESUPERSTOMP
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gitprogram.com | address UTA0560 Host associated with cloud.shinewrist[.]net gitprogram[.]com Domain JungleBamboo Phishing, exploit delivery, and C2 in |
| domain | ocr.opusaccel.top | 0560 Exploit-hosting and command-and-control infrastructure ocr[.]opusaccel[.]top Domain UTA0560 GRIMWEDGE JScript backdoor C2 endpoint 2 |
| domain | shinewrist.net | Compromise Indicator Type Actor Description / SHA256 cloud.shinewrist[.]net Domain UTA0560 Exploit-hosting and command-and-control in |
| ipv4 | 206.166.251.164 | .]top Domain UTA0560 GRIMWEDGE JScript backdoor C2 endpoint 206[.]166[.]251[.]164 IP address UTA0560 Host associated with cloud.shinewr |
| sha256 | 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 | 256 UTA0560 msgbox.exe GRIMWEDGE loader, a Win32 executable 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 SHA-256 JungleBamboo a001 LONGTALE malicious Chrome extensi |
| sha256 | 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc | mber 2 phishing URL serving the shared Chrome exploit chain 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc SHA-256 UTA0560 msgbox.exe GRIMWEDGE loader, a Win32 execut |
| url | https://proof.gitprogram.com/a4/j8 | gleBamboo Phishing, exploit delivery, and C2 infrastructure hxxps://proof.gitprogram[.]com/a4/j8 URL JungleBamboo September 2 phishing URL serving the sha |
From the original article
3 min read at gbhackers.com
China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.