Chinese Actors Chain Chrome and Windows Zero-Days

In September 2026, two Chinese threat clusters, UTA0560 and JungleBamboo (APT31), were observed leveraging a sophisticated multi-stage exploit chain targeting U.S.-based NGOs. The campaign, dubbed 'BlueMoon', exploited a 'patch gap' where vulnerabilities (CVE-2026-85046 and CVE-2026-87491) were fixed in the open-source Chromium codebase but remained unpatched in stable Google Chrome releases. This allowed actors to utilize zero-day capabilities against Chrome users before the official vendor updates arrived.

The technical workflow involved a reflected XSS redirecting victims to an exploit landing page. The chain utilized a V8 type-confusion bug and a WebAssembly defect to escape the browser sandbox, followed by a Windows kernel privilege escalation (CVE-2026-85880) to achieve full system access. While the exploit code was byte-for-byte identical across both actors, their post-exploitation objectives differed: UTA0560 deployed the GRIMWEDGE JScript backdoor for reconnaissance, while JungleBamboo utilized the SUPERSTOMP loader to install LONGTALE, a malicious Chrome extension designed for extensive credential and session theft.

This activity highlights the critical risk of patch gaps in open-source components and the increasing speed at which threat actors weaponize upstream security fixes. Organizations should prioritize browser updates and monitor for unauthorized Chrome extension installations or unusual Windows scheduled tasks.