China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

Summary

A Chinese threat actor, UTA0560, is using a sophisticated exploit chain involving zero-day vulnerabilities in Chrome and Windows to deploy the GRIMWEDGE JavaScript backdoor. The campaign targets NGOs via spear-phishing emails that leverage a reflected XSS vulnerability on a university website to redirect victims to malicious infrastructure. The backdoor provides initial access for reconnaissance and further payload delivery.

Full text

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE Ravie LakshmananSep 15, 2026Vulnerability / Cyber Espionage A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. "The emails contained a message encouraging the users to click a link that led to the website of a U.S.-based university," researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster said. "These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain." The exploit chain, as previously highlighted by Proofpoint, involves three separate flaws – two in Chrome and one in Windows Advanced Local Procedure Call (ALPC). It first abuses CVE-2026-85046 to gain arbitrary read/write within the V8 sandbox, then escapes the browser sandbox via CVE-2026-87491, and finally employs CVE-2026-85880 to inject code into the Chrome browser process and achieve arbitrary code execution. UTA0560 has been observed relying on this attack method to deploy GRIMWEDGE, which facilitates host reconnaissance, file and process management, command execution, and payload delivery capabilities. It all begins with a spear-phishing email that persuades a recipient into clicking on an embedded link pointing to a legitimate website susceptible to a reflective XSS vulnerability. The threat actor is said to have leveraged this flaw to trigger the zero-day exploit chain, also called BlueMoon, to deliver the malware, while filtering out systems not using Chrome on Windows to visit the URL. The final exploit page embeds three binary payloads as Base64-encoded strings within JavaScript - p1, shellcode that reflectively loads a DLL to conduct host reconnaissance and fingerprinting p2, shellcode that reflectively loads a DLL to facilitate Windows kernel privilege escalation pp, shellcode to perform browser process injection and payload download In the case of UTA0560, the next-stage payload is an executable named "msgbox.exe," which serves as a loader responsible for extracting from itself a legitimate Windows binary and a malicious DLL ("wsc.dll") to initiate a DLL sideloading chain. The DLL, for its part, contacts the same server to fetch a text file that's named after the device's hostname obtained during the profiling step. The text file is an MSI installer designed to execute an obfuscated JavaScript backdoor contained within the MSI custom actions. Once launched, GRIMWEDGE enters a persistent command loop that polls a command-and-control (C2) server ("ocr.opusaccel[.]top") to receive further instructions that are then executed in memory via the eval() command. It's equipped to parse the following commands - Info, to perform system reconnaissance Dir, to fetch a directory listing Mkdir, to create a directory Del, to delete a file Tasklist, to enumerate running processes Taskkill, to kill a process by PID Type, to read a file up to 5 MB Run, to execute a command within a hidden window Upload (chunk), to get a Base64-encoded chunk from the C2 server and append to an in-memory buffer Upload (commit), to save the accumulated buffer to disk as the final file "The code has no built-in persistence, lateral movement, or exfiltration mechanism beyond the file-read and upload commands," the researchers said. "The backdoor provides an initial foothold on a compromised host sufficient enough for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via the Run and Upload commands." Volexity said it also observed a second China-nexus threat actor known as JungleBamboo (aka APT31) using the same exploit chain around the same time to deploy a loader named SUPERSTOMP, which then installs LONGTALE, a credential-stealing Chrome extension also referred to as GemStone, from a remote server. It masquerades as a Google Gemini Chrome extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei) to evade detection, while supporting the following features - Keylogging and form capture Cookie and session theft Screenshot capture by monitoring page content for keywords supplied by a C2 server Bulk exfiltration of keystrokes, cookies, storage data, navigation history, and session metadata to the C2 server at roughly 30-second intervals Remote command and control "LONGTALE lacks even a basic remote code execution command that would enable the threat actor to conduct additional post-exploitation activity on compromised devices," Volexity said, adding it's possible "the threat actor regarded this feature as unnecessary, as the extensive information-theft capabilities offered by LONGTALE were sufficient to achieve JungleBamboo's credential theft and surveillance objectives." The near-simultaneous use of the same Chrome-Windows chain by multiple threat actors in China has raised the possibility that it may have been sold, or made available, to them by the exploit developer after possibly reverse-engineering the changes in the Chromium source code. What's notable here is the patch gap: while the fixes for the two Chrome flaws were pushed to the open-source Chromium codebase, they had not been incorporated into a stable release version of Google Chrome. In other words, the upstream patches created an unusual case of two N-day bugs that were addressed in Chromium, but not in Chrome. This, in turn, made them zero-days against Chrome. Given that Chrome relied on a four-week release cycle for major milestone releases until last week (it's every two weeks now), it's possible the attackers sought to move quickly before the exploitation window closed and the official patches arrived from Google. Volexity said, "patch-gap vulnerabilities present an even greater risk, as they create an additional time window for threat actors to conduct exploitation campaigns [...] as large language models become more popular and effective for rapid vulnerability research and exploit development." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  cyber espionage, Google Chrome, Malware, Microsoft Windows, Phishing, Vulnerability, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and And

Indicators of Compromise

• cve — CVE-2026-85046
• cve — CVE-2026-87491
• cve — CVE-2026-85880

Entities