A Chinese threat actor just pulled off a nasty attack chain. They used two Chrome bugs and one Windows flaw to drop a JavaScript backdoor called GRIMWEDGE. The targets were NGOs. The date was September 1, 2026.

Volexity found the campaign. They track the group as UTA0560.

Here's the part that makes this interesting. The Chrome bugs were already patched in Chromium, but not in Chrome itself. That patch gap turned two N-days into zero-days. The attackers moved fast before Google closed the window.

Let me break it down.

Quick Summary

How the Attack Started

It began with a spear-phishing email. The message encouraged recipients to click a link. That link pointed to a U.S. university website. But the attackers had found a reflected XSS vulnerability on that site.

The XSS let them redirect victims to their own infrastructure. That's where the exploit chain lived. The page filtered out anyone not using Chrome on Windows. If you didn't match, you saw nothing.

For those who did match, the page embedded three binary payloads as Base64 strings. Each had a job.

• p1: Shellcode that loads a DLL for host reconnaissance and fingerprinting
• p2: Shellcode that loads a DLL for Windows kernel privilege escalation
• pp: Shellcode for browser process injection and payload download

The BlueMoon Exploit Chain

This is the technical heart of the attack. It uses three separate flaws.

• CVE-2026-85046 is a Chrome bug. It gives the attacker arbitrary read/write inside the V8 sandbox.
• CVE-2026-87491 is another Chrome bug. It escapes the browser sandbox.
• CVE-2026-85880 is a Windows ALPC flaw. It injects code into the Chrome browser process and achieves arbitrary code execution.

Together, they form the BlueMoon chain. It's a full browser-to-kernel compromise.

The GRIMWEDGE Backdoor

Once the exploit chain runs, it drops a loader called msgbox.exe. That loader extracts two things from itself: a legitimate Windows binary and a malicious DLL called wsc.dll.

The DLL sideloading chain kicks in. wsc.dll contacts the attacker's server. It fetches a text file named after the victim's hostname, which was collected during the profiling step.

That text file is an MSI installer. Inside the MSI custom actions, there's an obfuscated JavaScript backdoor. That's GRIMWEDGE.

Once running, GRIMWEDGE enters a command loop. It polls a C2 server at ocr.opusaccel[.]top. It receives instructions and runs them in memory using eval().

What GRIMWEDGE Can Do:

Volexity notes the backdoor has no built-in persistence, lateral movement, or exfiltration beyond file read and upload. But that's enough to survey the host, grab files, and deploy more tooling.

The Second Threat Actor: JungleBamboo

UTA0560 wasn't the only group using this chain. Volexity saw a second China-nexus actor called JungleBamboo (also known as APT31) using the same exploit around the same time.

JungleBamboo deployed a loader called SUPERSTOMP. That loader installs LONGTALE, a credential-stealing Chrome extension. It also goes by GemStone. It pretends to be a Google Gemini extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei).

What LONGTALE Does:

• Keylogging and form capture
• Cookie and session theft
• Screenshot capture based on C2-supplied keywords
• Bulk exfiltration of keystrokes, cookies, storage data, history, and session metadata every ~30 seconds
• Remote command and control

Volexity notes LONGTALE lacks a remote code execution command. The researchers think the actor considered it unnecessary. The information theft was enough for credential theft and surveillance.

The Patch Gap Problem

Here's the twist. The two Chrome bugs were patched in Chromium, the open-source project. But they hadn't made it into a stable Chrome release. That's a patch gap.

Chromium is the upstream. Chrome is the downstream. When a fix lands in Chromium, it still has to go through Chrome's release process. Until it does, the bug is fixed in one place and still exploitable in another.

In this case, the attackers had a window. They used it. They moved fast because they knew the official Chrome patch was coming.

Volexity points out that patch-gap vulnerabilities are extra dangerous. They create a window where attackers can exploit a bug that's technically already fixed. And as AI gets better at finding vulnerabilities, those windows might get smaller but more intense.

What You Should Do

1. Update Chrome now.

If you haven't updated to the latest version, do it. The fix is out there.

2. Patch Windows.

CVE-2026-85880 is the vulnerability of Windows ALPC. Make sure that you are patched.

3. Find infections of GRIMWEDGE

Look for links to ocr.opusaccel[.]top. Search for msgbox.exe and wsc.dll. Also detect MSI files along with obfuscated JavaScript codes.

4. Find LONGTALE.

Search for the Chrome extension "ckiknalbeplpcpofpnabcnhjcegckfei" and if detected then remove it.

5. Educate users about spear-phishing attacks.

The attack was initiated with an email. Users have to be cautious when using any links, even legitimate. XSS attack can use any trusted domain name.

6. Monitor for patch gaps.

Keep an eye on Chromium commits. If a security fix lands upstream but isn't in Chrome yet, that's a window of risk.

The Bottom Line

A Chinese threat actor used a Chrome-Windows exploit chain to deliver GRIMWEDGE. They hit NGOs on September 1, 2026. The chain abused two Chrome bugs and one Windows flaw. A patch gap turned two N-days into zero-days. Update Chrome. Patch Windows. Watch for the backdoor.

Quick Reference:

What to Do:

• Update Chrome
• Patch Windows
• Watch for GRIMWEDGE indicators
• Check for LONGTALE extension
• Train users on spear-phishing
• Monitor for patch gaps

FAQ Section

What is GRIMWEDGE?

A JavaScript backdoor delivered by UTA0560. It provides host reconnaissance, file and process management, command execution, and payload delivery.

What is the BlueMoon exploit chain?

It's a chain of three flaws: two Chrome bugs (CVE-2026-85046, CVE-2026-87491) and one Windows ALPC bug (CVE-2026-85880). It gives full browser-to-kernel code execution.

Who is UTA0560?

China-linked threat actor. Tracked by Volexity. They targeted NGOs on September 1, 2026.

What is LONGTALE?

It is a credential stealing Chrome Extension used by JungleBamboo (APT31). It pretends to be a Google Gemini extension. It steals keys, cookies and other data.

What is a patch gap?

It refers to the availability of a patch in the upstream project (such as Chromium), but its absence in the downstream project (such as Chrome). The attackers take advantage of the vulnerability of the downstream project until the patch is released.

Source: The Hacker News