Chinese Threat Actors Chain Chrome and Windows Zero-Days for Espionage
Multiple Chinese threat actors are exploiting a sophisticated chain of zero-day vulnerabilities in Google Chrome and Windows to achieve code execution and deploy backdoors and credential stealers.
Volexity has uncovered a coordinated campaign involving multiple Chinese threat actors, specifically UTA0560 and JungleBamboo (also known as APT31/Violet Typhon/TA412), who are leveraging a complex exploit chain that abuses zero-day vulnerabilities in Google Chrome and the Windows kernel. The campaign, detected on September 1, 2026, targeted customers at various non-governmental organizations (NGOs) through spear-phishing emails.
The initial vector involved emails containing links that exploited a reflected cross-site scripting (XSS) vulnerability on a U.S. university website. This redirection led victims to threat-actor-controlled infrastructure hosting a multi-stage exploit chain. The chain begins with CVE-2026-85046, a type-confusion vulnerability in Google Chrome's V8 JavaScript engine. This vulnerability allows for arbitrary read/write operations within the V8 sandbox. It is then chained with CVE-2026-87491, a WebAssembly sandbox escape vulnerability, to break out of the V8 sandbox.
The exploit chain's sophistication is further highlighted by its use of CVE-2026-85880, a Windows kernel vulnerability. This flaw enables the attackers to escape Chrome's sandboxed renderer process and inject code directly into the Chrome browser process. This level of access allows for the deployment of custom payloads on the victim's system. Notably, the Chrome vulnerability (CVE-2026-85046) was fixed upstream in the Chromium project but had not yet been released in a stable version of Google Chrome at the time of the attacks, creating an effective zero-day for Chrome users.
Volexity observed two distinct post-exploitation activities from the different threat actors. UTA0560 deployed the GRIMWEDGE JScript backdoor, which provides capabilities for host reconnaissance, file and process management, command execution, and further payload delivery. This backdoor is designed to gather intelligence and maintain a persistent presence on compromised systems.
In parallel, JungleBamboo utilized a loader named SUPERSTOMP to install the LONGTALE credential-stealing Chrome extension. This indicates a focus on exfiltrating sensitive user data, particularly credentials stored within the Chrome browser, which can then be used for further lateral movement or access to other services.
The exploit chain itself was byte-for-byte identical across both threat actors, suggesting a shared source or exploit kit. The initial landing page, disguised as a donation form to match UTA0560's previous lures, served an obfuscated JavaScript loader. This loader performed checks on the User-Agent and operating system, ensuring that only Chrome instances running on Windows proceeded to the next stage of the exploit.
This incident underscores the persistent threat posed by Chinese state-aligned threat actors and their ability to chain multiple vulnerabilities, including zero-days, to achieve their espionage objectives. The use of a known but unpatched vulnerability in Chrome, combined with Windows kernel exploits, demonstrates a high level of technical sophistication and a keen awareness of the "patch gap" to maximize exploit success rates against targeted organizations.