A newly disclosed chain of vulnerabilities in Google Chrome and the Windows kernel can compromise targets, deploy espionage malware, and steal browser credentials.
According to Volexity, UTA0560 and JungleBamboo, also tracked as APT31, Violet Typhoon, and TA412, used an identical multi-stage exploit chain in spear-phishing operations against different victim sets.
The campaign abused Chrome vulnerability CVE-2026-85046, a type-confusion flaw in the V8 JavaScript engine.
Chinese Hackers Chain Chrome and Windows Zero-Days
Although a fix had entered the open-source Chromium codebase, it was not yet available in a released Chrome update during the attacks. This created a patch-gap condition: technically an N-day in Chromium source, but an effective zero-day for Chrome users.
Victims received phishing emails containing links to legitimate websites vulnerable to reflected cross-site scripting (XSS). The attackers used the XSS flaw to redirect recipients to attacker-controlled infrastructure hosting the exploit framework.
The landing page displayed a convincing donation-form image tailored to the victim organization while a hidden iframe launched the exploit in the background.
The chain first exploited CVE-2026-85046 to gain arbitrary read/write access within Chrome’s V8 sandbox. It then abused a WebAssembly sandbox-escape flaw, tracked as CVE-2026-87491.
A third vulnerability, a Windows kernel flaw CVE-2026-85880, enabled local privilege escalation through the RtlpCreateServerAcl function. The kernel exploit allowed the attackers to break out of Chrome’s restricted renderer process and inject code into the main Chrome browser process.
The exploit code ran inside a Web Worker and included an automatic retry mechanism, enabling up to five exploitation attempts without crashing the user-visible browser tab.
It also performed host fingerprinting, collecting Windows version, token privileges, processor features, and virtualization indicators before deciding whether to execute the kernel privilege-escalation stage.
While the browser and Windows exploit components were reportedly byte-for-byte identical, the two groups deployed different post-exploitation payloads.
UTA0560 used the chain to install GRIMWEDGE, a JScript backdoor delivered through a loader called msgbox.exe. The loader extracted a legitimate executable and malicious DLL for DLL sideloading, then created a scheduled task named “Windows Scheduled System” for persistence.
GRIMWEDGE executes in memory within msiexec.exe and supports reconnaissance, directory enumeration, file theft, process listing and termination, command execution, and chunked file uploads. Its command-and-control traffic includes victim domain, username, and command output.
JungleBamboo instead delivered SUPERSTOMP, a Chrome extension installer that tampers with Chrome Secure Preferences.
The tool bypassed newer extension-integrity protections by removing encrypted hashes, inserting a malicious extension configuration, and generating valid legacy HMAC values.
The resulting LONGTALE extension masqueraded as a Google Gemini extension and provided extensive browser-surveillance capabilities.
It captured keystrokes, form values, clipboard contents, browser cookies, local and session storage tokens, screenshots triggered by attacker-defined keywords, browsing history, and session metadata.
Volexity assessed that the core exploit chain may have been shared or sold among separate Chinese operators.
The researchers also warned that publicly visible upstream fixes can give threat actors a narrow but valuable window to reverse engineer vulnerabilities before downstream vendors ship browser updates.
Organizations should prioritize rapid Chrome and Windows patching, inspect browser-extension deployments, monitor for Secure Preferences tampering, and investigate phishing links that redirect through compromised legitimate websites.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
