China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

Summary: Volexity attributed a spear-phishing campaign targeting multiple NGOs on September 1, 2026 to a China-linked cluster it calls UTA0560, which used reflected XSS on a U.S. university website to redirect recipients to a three-flaw Chrome and Windows ALPC exploit chain delivering the GRIMWEDGE JavaScript backdoor. The chain abuses CVE-2026-85046 for read/write in the V8 sandbox, CVE-2026-87491 to escape the browser sandbox, and CVE-2026-85880 to inject code into the Chrome browser process, while a second China-nexus actor, JungleBamboo (APT31), used the same chain to deploy SUPERSTOMP and the credential-stealing Chrome extension LONGTALE, disguised as a Google Gemini extension.
Why it matters: The two Chrome fixes had landed in the open-source Chromium codebase but not in a stable Chrome release, turning patched upstream bugs into live zero-days against Chrome users - and two separate China-linked actors exploited that window at nearly the same time, suggesting the chain may have been sold or shared.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-85046 CVE-2026-85880 CVE-2026-87491
Related: Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week Cyber Risks ·
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware Cyber Risks ·
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows Cyber Risks ·