China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE.

Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026.

"The emails contained a message encouraging the users to click a link that led to the website of a U.S.-based university," researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster said. "These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain."

The exploit chain, as previously highlighted by Proofpoint, involves three separate flaws – two in Chrome and one in Windows Advanced Local Procedure Call (ALPC). It first abuses CVE-2026-85046 to gain arbitrary read/write within the V8 sandbox, then escapes the browser sandbox via CVE-2026-87491, and finally employs CVE-2026-85880 to inject code into the Chrome browser process and achieve arbitrary code execution.

UTA0560 has been observed relying on this attack method to deploy GRIMWEDGE, which facilitates host reconnaissance, file and process management, command execution, and payload delivery capabilities. It all begins with a spear-phishing email that persuades a recipient into clicking on an embedded link pointing to a legitimate website susceptible to a reflective XSS vulnerability.

The threat actor is said to have leveraged this flaw to trigger the zero-day exploit chain, also called BlueMoon, to deliver the malware, while filtering out systems not using Chrome on Windows to visit the URL. The final exploit page embeds three binary payloads as Base64-encoded strings within JavaScript -

• p1, shellcode that reflectively loads a DLL to conduct host reconnaissance and fingerprinting
• p2, shellcode that reflectively loads a DLL to facilitate Windows kernel privilege escalation
• pp, shellcode to perform browser process injection and payload download

In the case of UTA0560, the next-stage payload is an executable named "msgbox.exe," which serves as a loader responsible for extracting from itself a legitimate Windows binary and a malicious DLL ("wsc.dll") to initiate a DLL sideloading chain. The DLL, for its part, contacts the same server to fetch a text file that's named after the device's hostname obtained during the profiling step.

The text file is an MSI installer designed to execute an obfuscated JavaScript backdoor contained within the MSI custom actions. Once launched, GRIMWEDGE enters a persistent command loop that polls a command-and-control (C2) server ("ocr.opusaccel[.]top") to receive further instructions that are then executed in memory via the eval() command. It's equipped to parse the following commands -

• Info, to perform system reconnaissance
• Dir, to fetch a directory listing
• Mkdir, to create a directory
• Del, to delete a file
• Tasklist, to enumerate running processes
• Taskkill, to kill a process by PID
• Type, to read a file up to 5 MB
• Run, to execute a command within a hidden window
• Upload (chunk), to get a Base64-encoded chunk from the C2 server and append to an in-memory buffer
• Upload (commit), to save the accumulated buffer to disk as the final file

"The code has no built-in persistence, lateral movement, or exfiltration mechanism beyond the file-read and upload commands," the researchers said. "The backdoor provides an initial foothold on a compromised host sufficient enough for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via the Run and Upload commands."

Volexity said it also observed a second China-nexus threat actor known as JungleBamboo (aka APT31) using the same exploit chain around the same time to deploy a loader named SUPERSTOMP, which then installs LONGTALE, a credential-stealing Chrome extension also referred to as GemStone, from a remote server. It masquerades as a Google Gemini Chrome extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei) to evade detection, while supporting the following features -

• Keylogging and form capture
• Cookie and session theft
• Screenshot capture by monitoring page content for keywords supplied by a C2 server
• Bulk exfiltration of keystrokes, cookies, storage data, navigation history, and session metadata to the C2 server at roughly 30-second intervals
• Remote command and control

"LONGTALE lacks even a basic remote code execution command that would enable the threat actor to conduct additional post-exploitation activity on compromised devices," Volexity said, adding it's possible "the threat actor regarded this feature as unnecessary, as the extensive information-theft capabilities offered by LONGTALE were sufficient to achieve JungleBamboo's credential theft and surveillance objectives."

The near-simultaneous use of the same Chrome-Windows chain by multiple threat actors in China has raised the possibility that it may have been sold, or made available, to them by the exploit developer after possibly reverse-engineering the changes in the Chromium source code.

What's notable here is the patch gap: while the fixes for the two Chrome flaws were pushed to the open-source Chromium codebase, they had not been incorporated into a stable release version of Google Chrome. In other words, the upstream patches created an unusual case of two N-day bugs that were addressed in Chromium, but not in Chrome. This, in turn, made them zero-days against Chrome.

Given that Chrome relied on a four-week release cycle for major milestone releases until last week (it's every two weeks now), it's possible the attackers sought to move quickly before the exploitation window closed and the official patches arrived from Google.

Volexity said, "patch-gap vulnerabilities present an even greater risk, as they create an additional time window for threat actors to conduct exploitation campaigns [...] as large language models become more popular and effective for rapid vulnerability research and exploit development."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.