China-linked hackers deploy chained Chrome-Windows zero-day exploits

China-linked threat actors have been caught chaining two Google Chrome flaws with a Windows kernel vulnerability to compromise selected targets, including non-governmental organisations, in espionage campaigns detected this month.

Cybersecurity firm Volexity said the activity involved two separate groups it tracks as UTA0560 and JungleBamboo, the latter also known as APT31, Violet Typhoon and TA412. Both used the same core browser-to-kernel exploit chain, but installed different post-exploitation tools after gaining access to victims’ systems.

The campaigns were detected on September 1. Phishing emails sent by UTA0560 directed recipients through a reflected cross-site scripting weakness on a legitimate US university website to attacker-controlled infrastructure. Victims who clicked the link were shown a decoy donation form while malicious code ran inside Chrome.

The exploit chain first abused CVE-2026-85046, a type-confusion vulnerability in Chrome’s V8 JavaScript engine, to obtain arbitrary read-and-write capability within the V8 sandbox. It then used CVE-2026-87491, an out-of-bounds write flaw affecting V8 and WebAssembly processing, to escape that layer of isolation.

A third vulnerability, CVE-2026-85880, was then used to elevate privileges through the Windows kernel and break out of Chrome’s sandboxed renderer process. The exploit injected code into the main Chrome browser process, allowing the attackers to download and execute their chosen payload.

Volexity said the shellcode used by UTA0560 and JungleBamboo was byte-for-byte identical even though the campaigns relied on different infrastructure and malware. The overlap led the company to assess, with low confidence, that the exploit chain may have been sold or otherwise supplied to multiple operators in China.

UTA0560 deployed a JScript backdoor that Volexity named GRIMWEDGE. The malware can collect system information, list directories and running processes, read and delete files, execute commands, terminate processes and receive additional files from its command-and-control infrastructure.

The group’s infection chain also established persistence through a scheduled Windows task and used a victim-specific staging mechanism based on the compromised computer’s hostname. Volexity said the backdoor itself runs in memory and gives the operator a foothold for reconnaissance, file collection and deployment of additional tooling.

JungleBamboo instead used a loader dubbed SUPERSTOMP to install a malicious Chrome extension called LONGTALE. The extension masqueraded as a Google Gemini-related browser add-on and concentrated on credential theft and surveillance rather than providing broad remote-code-execution functions.

LONGTALE can record keystrokes and form entries, capture pasted clipboard material, steal cookies and browser-session tokens, take screenshots when specified keywords appear on a page and periodically send collected data to attacker-controlled infrastructure. It can also receive commands to trigger data collection or make cross-origin web requests from the victim’s browser context.

The attacks exploited what researchers described as a “patch gap” between fixes entering the open-source Chromium codebase and corresponding updates reaching stable Google Chrome users. CVE-2026-85046 had been reported on August 4 and fixed upstream before the September 1 attacks, but the repair had not yet reached the stable Chrome channel.

Volexity said dates embedded in the exploit code indicated development between August 27 and August 29, underscoring how quickly attackers appeared able to weaponise fixes visible in Chromium source code before stable browser releases had delivered them to users across ordinary enterprise and desktop environments.

Google released Chrome 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux on September 3 with a fix for CVE-2026-85046, saying an exploit for the flaw existed in the wild.

Google subsequently released Chrome 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, addressing CVE-2026-87491. The company also confirmed active exploitation of that vulnerability. Security advisories have urged organisations and individual users to update affected Chrome installations promptly.

Microsoft patched CVE-2026-85880 as part of its September security updates. The Windows flaw is a heap-based buffer-overflow issue in the Advanced Local Procedure Call mechanism that can allow an authorised local attacker to elevate privileges.