Chinese Actors Chain Chrome and Windows Zero-Days

In September 2026, Volexity identified two distinct Chinese threat clusters, UTA0560 and JungleBamboo, independently utilizing an identical exploit chain. This chain leveraged a 'patch gap' where vulnerabilities (CVE-2026-85046 and CVE-2026-87491) were fixed in the Chromium source code but had not yet reached a stable Google Chrome release, effectively functioning as zero-days. The exploit further integrated a Windows kernel vulnerability (CVE-2026-85880) to escape the browser sandbox and achieve elevated code execution.

While the exploit code was identical, the actors deployed different post-exploitation payloads. UTA0560 delivered GRIMWEDGE, a JScript backdoor used for reconnaissance and further malware staging. JungleBamboo (attributed with medium confidence to APT31) deployed SUPERSTOMP, a loader that installs a malicious Chrome extension named LONGTALE (also known as GemStone). This extension facilitates pervasive credential theft and session hijacking by masquerading as a legitimate Google Gemini extension.

The simultaneous use of the same exploit code by separate groups suggests a shared supply chain or an exploit broker model within the Chinese offensive ecosystem. The campaign underscores the critical risk posed by patch gaps and the increasing use of malicious browser extensions to bypass traditional endpoint security controls.