JungleBamboo and UTA0560 Exploit Chrome-Windows Patch Gap

In September 2026, Volexity identified a coordinated series of spear-phishing campaigns by Chinese threat actors UTA0560 and JungleBamboo (APT31). The actors exploited a unique 'patch gap' where vulnerabilities (CVE-2026-85046, CVE-2026-87491) were fixed in the open-source Chromium codebase but remained unpatched in stable Google Chrome releases. This allowed the actors to chain these browser flaws with a Windows kernel vulnerability (CVE-2026-85880) to achieve arbitrary code execution on victim hosts.

Technically, the campaign used reflected XSS on legitimate university sites to redirect targets to an exploit landing page. The chain includes initial host reconnaissance, kernel-level privilege escalation, and browser process injection. While both actors used byte-for-byte identical exploit shellcode, their post-exploitation objectives diverged. UTA0560 deployed the GRIMWEDGE JScript backdoor via DLL sideloading, while JungleBamboo utilized the SUPERSTOMP loader to install LONGTALE, a credential-stealing Chrome extension masquerading as Google Gemini.

This activity highlights the critical risk of patch gaps in the software supply chain. The rapid adoption of fixed-but-unreleased vulnerabilities suggests a shared exploit broker or highly efficient reverse-engineering capabilities within the Chinese threat ecosystem. Organizations, particularly NGOs and government-adjacent entities, are advised to monitor for specific Chrome extension tampering and unusual sideloading behaviors in system directories.