China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. "The
Chinese threat actors have been identified as deploying a sophisticated series of attacks that exploited multiple zero-day vulnerabilities in Google Chrome and the Windows operating system. The campaigns, detected on September 1, involved two groups, UTA0560 and JungleBamboo, both leveraging the same core exploit chain but installing distinct post-exploitation tools.
The initial entry point was a phishing email containing a malicious link that directed victims to a legitimate university website, exploiting a cross-site scripting vulnerability. This led to the execution of malicious code within the Chrome browser, which then exploited a combination of browser and Windows kernel vulnerabilities to gain deep system access.
The exploit chain began with CVE-2026-85046, a type-confusion flaw in Chrome's V8 JavaScript engine, enabling arbitrary read-and-write capabilities within the V8 sandbox. Following this, CVE-2026-87491, an out-of-bounds write flaw affecting V8 and WebAssembly processing, was used to escape the sandboxed renderer process. Finally, CVE-2026-85880 was leveraged to elevate privileges through the Windows kernel, allowing attackers to break out of Chrome and install their chosen payload.
The attackers used identical shellcode for both groups but installed different malware - GRIMWEDGE, a JScript backdoor, for UTA0560 and SUPERSTOMP, a loader for a malicious Chrome extension, for JungleBamboo. GRIMWEDGE collected system information, listed directories and processes, read and deleted files, executed commands, terminated processes, and received additional files from its command-and-control infrastructure.
SUPERSTOMP installed a malicious Chrome extension, LONGTALE, which focused on credential theft and surveillance, recording keystrokes, capturing clipboard material, stealing cookies, taking screenshots, and sending collected data to attacker-controlled servers. The attacks highlight a "patch gap" between Chromium fixes and their deployment in stable Chrome releases, as one of the exploited vulnerabilities, CVE-2026-85046, had been reported and fixed prior to the attacks.
Google and Microsoft have released patches for the affected vulnerabilities, urging users to update their Chrome installations promptly.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- China-linked hackers deploy chained Chrome-Windows zero-day exploits thearabianpost.com
