Chinese cyber attackers have been linked to a sophisticated spear-phishing operation exploiting vulnerabilities in Google Chrome and Microsoft Windows. This campaign aims to deploy a harmful JavaScript backdoor known as GRIMWEDGE, targeting multiple non-governmental organizations.
Exploitation of Chrome and Windows Vulnerabilities
Volexity, tracking the threat under the identifier UTA0560, identified the attack as occurring on September 1, 2026. The attackers sent emails urging recipients to click a link to a U.S.-based university website. This link exploited a cross-site scripting vulnerability to redirect users to a malicious site.
The exploitation strategy, detailed by Proofpoint, involves three separate security flaws: two in Chrome and one in Windows Advanced Local Procedure Call. The attackers first utilize CVE-2026-85046 for arbitrary read/write within the V8 sandbox. This is followed by escaping the browser sandbox using CVE-2026-87491, and finally, employing CVE-2026-85880 to execute arbitrary code in the Chrome process.
Deployment of GRIMWEDGE Malware
UTA0560’s method involves spear-phishing emails that direct users to vulnerable websites, triggering the exploit chain known as BlueMoon. This chain selectively delivers malware to systems using Chrome on Windows. The final stage involves embedding three binary payloads as Base64-encoded strings within JavaScript, each serving distinct roles in the attack.
The payload execution culminates in the deployment of “msgbox.exe,” which extracts a legitimate Windows binary and a malicious DLL to initiate a DLL sideloading routine. This sequence leads to a text file download, executed as an MSI installer, embedding the GRIMWEDGE backdoor for ongoing command and control server interactions.
Involvement of Additional Threat Actors
In parallel, another China-linked group, JungleBamboo (also known as APT31), exploited the same vulnerabilities to deploy the SUPERSTOMP loader, which installs the LONGTALE credential-stealing extension. Disguised as a legitimate Chrome extension, LONGTALE conducts keylogging, form capture, and data exfiltration to a command and control server.
The simultaneous exploitation by different groups raises concerns about the possible sale or distribution of these exploits. Notably, the vulnerabilities had been patched in the Chromium codebase but not yet in a stable Chrome release, creating a unique opportunity for attackers.
Implications and Future Outlook
The incident highlights the risks associated with patch-gap vulnerabilities, where fixes are present in source code but not yet deployed in user-facing software. This delay offers a critical window for cybercriminals to exploit unpatched systems. As threat actors increasingly leverage such opportunities, timely patch releases remain essential to mitigate potential security breaches.
Volexity stresses the importance of addressing these patch-gap vulnerabilities, emphasizing the evolving landscape where advanced tools and models accelerate the discovery and exploitation of security flaws.
