Chinese Hackers Use Chrome and Windows Zero-Days to Deploy GRIMWEDGE Malware

Chinese threat actors are deploying a sophisticated zero-day exploit chain targeting Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor known as GRIMWEDGE. The activity, attributed to a threat cluster identified as UTA0560, has specifically targeted several non-governmental organisations (NGOs).

Researchers at Volexity discovered the campaign, noting that the attack began around 1 September 2026. The threat actors utilised spear-phishing emails containing links to legitimate websites. These websites were vulnerable to reflected cross-site scripting (XSS), which allowed the attackers to redirect recipients to controlled infrastructure hosting a multi-stage exploit chain, often referred to as BlueMoon.

The BlueMoon Exploit Chain

The attack chain leverages three distinct security flaws to bypass modern browser and operating system protections. It first exploits CVE-2026-85046 to gain arbitrary read and write capabilities within the V8 sandbox. The attackers then use CVE-2026-87491 to escape the browser sandbox entirely.

To complete the execution, the actors employ CVE-2026-85880, which targets the Windows Advanced Local Procedure Call (ALPC) to inject code into the Chrome browser process. This sequence allows for arbitrary code execution on the victim’s machine.

Once the exploit is successful, GRIMWEDGE is deployed. The malware is designed for host reconnaissance, file and process management, and command execution. It establishes a persistent command loop by communicating with a command-and-control (C2) server, receiving instructions that are executed directly in memory.

Exploiting the Patch Gap

A significant factor in the success of these attacks is a phenomenon known as the patch gap. While fixes for the two Chrome vulnerabilities had been integrated into the open-source Chromium codebase, they had not yet been incorporated into the stable, official releases of Google Chrome at the time of exploitation.

This created a window of opportunity where the flaws functioned as zero-day vulnerabilities in the stable browser. Security researchers noted that such gaps present an increased risk as attackers move more quickly to exploit flaws before official patches are widely deployed to users.

Coordinated Use by Multiple Actors

Volexity also observed a second China-nexus threat actor, known as JungleBamboo (also called APT31), using the same Chrome and Windows exploit chain during the same period. In these instances, the actors deployed a loader called SUPERSTOMP to install LONGTALE, a credential-stealing Chrome extension.

LONGTALE, which masquerades as a legitimate Google Gemini extension, is designed for extensive surveillance. It is capable of keylogging, capturing form data, stealing cookies and session metadata, and taking screenshots. This secondary campaign focused heavily on information theft to achieve espionage objectives.

Users and organisations are advised to ensure that Google Chrome and Microsoft Windows are updated to the latest available versions to mitigate the risk of these known vulnerabilities.