China-linked hackers deploy chained Chrome-Windows zero-day exploits
China-linked threat actors have been caught chaining two Google Chrome flaws with a Windows kernel vulnerability to compromise selected targets, including non-governmental organisations, in espionage campaigns detected this month. Cybersecurity firm Volexity said the activity involved two separate groups it tracks as UTA0560 and JungleBamboo, the latter also known as APT31, Violet Typhoon and…
Chinese threat actors have been identified as deploying a sophisticated series of attacks that exploited multiple zero-day vulnerabilities in Google Chrome and the Windows operating system. The campaigns, detected on September 1, involved two groups, UTA0560 and JungleBamboo, both leveraging the same core exploit chain but installing distinct post-exploitation tools.
The initial entry point was a phishing email containing a malicious link that directed victims to a legitimate university website, exploiting a cross-site scripting vulnerability. This led to the execution of malicious code within the Chrome browser, which then exploited a combination of browser and Windows kernel vulnerabilities to gain deep system access.
The exploit chain began with CVE-2026-85046, a type-confusion flaw in Chrome's V8 JavaScript engine, enabling arbitrary read-and-write capabilities within the V8 sandbox. Following this, CVE-2026-87491, an out-of-bounds write flaw affecting V8 and WebAssembly processing, was used to escape the sandboxed renderer process. Finally, CVE-2026-85880 was leveraged to elevate privileges through the Windows kernel, allowing attackers to break out of Chrome and install their chosen payload.
The attackers used identical shellcode for both groups but installed different malware - GRIMWEDGE, a JScript backdoor, for UTA0560 and SUPERSTOMP, a loader for a malicious Chrome extension, for JungleBamboo. GRIMWEDGE collected system information, listed directories and processes, read and deleted files, executed commands, terminated processes, and received additional files from its command-and-control infrastructure.
SUPERSTOMP installed a malicious Chrome extension, LONGTALE, which focused on credential theft and surveillance, recording keystrokes, capturing clipboard material, stealing cookies, taking screenshots, and sending collected data to attacker-controlled servers. The attacks highlight a "patch gap" between Chromium fixes and their deployment in stable Chrome releases, as one of the exploited vulnerabilities, CVE-2026-85046, had been reported and fixed prior to the attacks.
Google and Microsoft have released patches for the affected vulnerabilities, urging users to update their Chrome installations promptly.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
