Chinese Actors Chain Chrome and Windows Zero-Days

In September 2026, Volexity identified a highly sophisticated campaign involving two distinct Chinese threat clusters, UTA0560 and JungleBamboo (APT31), leveraging a shared exploit chain. The campaign exploited a critical 'patch gap' where vulnerabilities were fixed in the open-source Chromium codebase but had not yet been integrated into a stable Google Chrome release. This provided a window for threat actors to utilize known N-day flaws as functional zero-days against the public.

The attack chain involves a multi-stage process: starting with spear-phishing and reflected XSS, followed by a Chrome V8 type confusion exploit (CVE-2026-85046), a sandbox escape (CVE-2026-87491), and finally a Windows kernel privilege escalation (CVE-2026-85880) to achieve full browser process injection. While the exploitation shellcode was byte-for-byte identical across both actors, their post-exploitation objectives diverged significantly.

UTA0560 targeted NGOs to deploy GRIMWEDGE, a lightweight JScript backdoor for reconnaissance and further payload delivery. Conversely, JungleBamboo utilized the SUPERSTOMP loader to install LONGTALE, a malicious Chrome extension masquerading as Google Gemini designed for mass credential theft and session hijacking. This activity highlights the increasing risk of rapid exploit development following upstream source code commits before vendor binary patches are widely available.