Multiple Chinese APTs Exploit Chrome and Windows Zero-Day Chain

In September 2026, Volexity identified a sophisticated campaign by Chinese-nexus threat actors UTA0560 and JungleBamboo leveraging a shared zero-day exploit chain. The attack utilized a 'patch gap' where fixes in the open-source Chromium codebase had not yet reached stable Google Chrome releases. The chain combined two Chrome vulnerabilities (CVE-2026-85046 and CVE-2026-87491) for sandbox escape and a Windows kernel vulnerability (CVE-2026-85880) for privilege escalation.

Following successful exploitation, UTA0560 deployed GRIMWEDGE, a JScript backdoor facilitating reconnaissance and further payload delivery. Simultaneously, JungleBamboo (APT31) utilized the chain to install LONGTALE, a malicious Chrome extension disguised as Google Gemini, specifically designed for mass credential theft and browser session hijacking. The identical nature of the exploit code suggests a common exploit developer or broker providing the capability to multiple Chinese state-sponsored groups.

This campaign underscores the critical risk posed by the delay between upstream open-source patches and downstream software releases, particularly for widely used browsers. The targeting of non-governmental organizations (NGOs) and the use of legitimate reflective XSS vulnerabilities to redirect targets further demonstrates the actors' focus on strategic espionage and credential acquisition.