China-Linked Hackers Chain Chrome and Windows Zero-Days to Breach NGOs

China-linked operators have compromised multiple non-governmental organizations by combining spear-phishing, a vulnerable university website, and three actively exploited Chrome and Windows flaws.

Volexity observed the attacks against NGO personnel on September 1, 2026. The activity was attributed to a cluster tracked as UTA0560, which deployed a JavaScript backdoor named GRIMWEDGE.

A second China-nexus group, JungleBamboo, also known as APT31, used the same exploit chain around the same time. Its campaign delivered a malicious Chrome extension designed to steal credentials, cookies, browsing data, and active sessions.

All three vulnerabilities are now in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Federal remediation deadlines fall between September 18 and September 23, 2026.

Spear-Phishing Links Turned a University Website Into a Launch Point

The UTA0560 campaign began with targeted emails sent to NGO employees. Recipients were encouraged to follow an embedded link pointing to a legitimate website operated by a US-based university.

That website contained a reflected cross-site scripting vulnerability. Rather than compromising the university server directly, the attackers abused the XSS weakness to redirect selected visitors toward infrastructure they controlled.

The identity of the university and the remediation status of its website are not known.

The malicious page filtered incoming traffic before delivering the exploit. Only visitors apparently using Google Chrome on Microsoft Windows proceeded through the complete infection sequence, reducing unnecessary exposure of the operators’ browser exploits.

The multi-stage chain, called BlueMoon, embedded three Base64-encoded payloads in JavaScript:

• p1 reflectively loaded a DLL used to identify and profile the host.
• p2 loaded another DLL responsible for Windows kernel privilege escalation.
• pp injected code into the browser process and retrieved the next payload.

This architecture separated reconnaissance, privilege escalation, and payload delivery. It also allowed the operators to stop the attack after fingerprinting a system that did not meet their targeting criteria.

Three Vulnerabilities Break Through Chrome and Windows Defenses

BlueMoon depended on two Chrome vulnerabilities followed by a Windows Advanced Local Procedure Call flaw.

The first stage exploited CVE-2026-85046, a V8 type-confusion vulnerability carrying a CVSS score of 8.8. A crafted HTML page could give a remote attacker arbitrary read-and-write capability inside the V8 sandbox, although victim interaction was required.

The operators then used CVE-2026-87491, an out-of-bounds write in V8 with a CVSS score of 8.8, to escape Chrome’s sandbox. Together, these browser flaws converted a malicious web visit into access beyond the normally isolated renderer environment.

The final step invoked CVE-2026-85880, a Windows ALPC heap-buffer overflow rated 7.8. The flaw permits a locally authorized attacker to elevate privileges. Within BlueMoon, it supported injection into the Chrome process and arbitrary code execution after the sandbox escape.

The chain therefore crossed several security boundaries. A victim first had to open the spear-phishing link, but no further interaction was described once the qualifying Chrome-on-Windows system reached the exploit page.

Researchers assessed that the browser vulnerabilities may have existed in a patch gap: corrections were present in the open-source Chromium codebase but had not yet reached a stable Chrome build. That interval can expose enough technical information for attackers to reconstruct a vulnerability before most users receive an official update.

The simultaneous appearance of BlueMoon in campaigns associated with two separate China-linked clusters suggests that its developer may have shared, sold, or otherwise distributed the capability. That remains an assessment rather than confirmed evidence of a common exploit supplier.

GRIMWEDGE Provides UTA0560 With an In-Memory Command Channel

Following exploitation, UTA0560 downloaded an executable called msgbox.exe. The file acted as a loader, extracting a legitimate Windows program alongside a malicious library named wsc.dll.

The pairing initiated DLL sideloading: the trusted executable loaded the attacker’s DLL because it appeared in a location or under a name that satisfied the program’s library search behavior.

The malicious DLL contacted the same attacker-controlled server and requested a text file whose name matched the victim computer’s hostname. The hostname had already been collected during BlueMoon’s profiling stage.

Despite its extension, the returned file was an MSI installer. Custom MSI actions launched an obfuscated JavaScript backdoor identified as GRIMWEDGE.

GRIMWEDGE repeatedly polls the command-and-control domain:

ocr.opusaccel[.]top

Commands are processed in memory through JavaScript’s eval() function. The supported operations allow attackers to:

• Collect system information and list directories.
• Create directories or delete files.
• Enumerate and terminate processes.
• Read files up to 5 MB.
• Run commands in hidden windows.
• Receive Base64-encoded file chunks in memory and write the completed payload to disk.

The malware does not include its own persistence or lateral-movement mechanism. Nor does it offer a dedicated, general-purpose exfiltration framework beyond its file-reading and transfer functions.

It is nevertheless an effective initial foothold. Operators can inspect the host, collect selected files, execute native commands, and upload additional tooling for later stages of an intrusion.

APT31 Used the Same Chain for Browser Credential Theft

JungleBamboo’s use of BlueMoon led to a different post-exploitation path. The APT31-linked operation deployed SUPERSTOMP, a loader that installed the credential-stealing Chrome extension LONGTALE, also called GemStone.

LONGTALE impersonates an extension associated with Google Gemini. Its Chrome extension identifier is:

ckiknalbeplpcpofpnabcnhjcegckfei

Once installed, the extension can record keystrokes and form submissions, steal cookies and browser sessions, capture screenshots, and collect local browser storage, navigation history, and session metadata.

Screenshot collection can be triggered by keywords supplied through command-and-control infrastructure. Stolen data is transmitted in batches at intervals of approximately 30 seconds.

Unlike GRIMWEDGE, LONGTALE does not expose a basic remote-code-execution command for deploying arbitrary follow-on tools. Its extensive browser surveillance functions may have been sufficient for APT31’s apparent focus on credential theft and intelligence collection.

The distinction matters operationally. UTA0560 sought a flexible endpoint foothold, while JungleBamboo concentrated on information already accessible through the victim’s browser—including authenticated sessions that could potentially bypass the need to re-enter a password.

Affected Versions and CISA Deadlines

The affected products and fixed-version thresholds are:

Vulnerability	Affected software	Vulnerable versions	CISA KEV entry	Federal deadline
CVE-2026-85046	Google Chrome; Google V8	Chrome before 152.0.7977.82; V8 before 15.3.48	September 4, 2026	September 18, 2026
CVE-2026-87491	Google Chrome	Before 153.0.8010.36	September 9, 2026	September 23, 2026
CVE-2026-85880	Windows 10, Windows Server	Builds listed below	September 8, 2026	September 22, 2026

For CVE-2026-85880, vulnerable Windows releases include:

• Windows 10 1607 before 10.0.14393.9512
• Windows 10 1809 before 10.0.17763.9245
• Windows 10 21H2 before 10.0.19044.7725
• Windows 10 22H2 before 10.0.19045.7725
• Windows Server 2016 before 10.0.14393.9512
• Windows Server 2019 before 10.0.17763.9245
• Windows Server 2022 before 10.0.20348.5622

Windows Server 2012 is also affected, but a precise vulnerable build threshold is not available.

The three additions are part of a broader run of Google and Microsoft vulnerabilities entering KEV. Other flaws involving those vendors added during the preceding 90 days include CVE-2026-81963, CVE-2019-1068, CVE-2026-33824, CVE-2026-55040, CVE-2026-68820, and CVE-2026-50522.

Patch Quickly, Then Hunt for Evidence of Compromise

Organizations should update Chrome to at least 153.0.8010.36, which exceeds the stated fixed thresholds for both browser vulnerabilities. Separately deployed or embedded V8 installations should be upgraded to 15.3.48 or later.

Affected Windows and Windows Server systems must be moved beyond the relevant vulnerable build. Windows Server 2012 administrators should follow Microsoft’s product-specific instructions because no exact build boundary has been disclosed.

CISA requires federal agencies to apply vendor mitigations under BOD 26-04 and follow its forensic-triage requirements. Its guidance also calls for assessing internet exposure and discontinuing affected products or services when an effective mitigation is unavailable.

Patching alone may not be sufficient for systems exposed before remediation. Defenders should search for:

msgbox.exe
wsc.dll
ocr.opusaccel[.]top
ckiknalbeplpcpofpnabcnhjcegckfei

Investigations should also examine MSI custom actions launching obfuscated JavaScript, suspicious DLL sideloading, unauthorized Chrome extensions, and emails linking through legitimate but XSS-vulnerable websites.

Endpoints showing any of these indicators should be treated as potentially compromised. Response teams should review credentials and active browser sessions, inspect cookies and local storage, and determine whether GRIMWEDGE uploaded additional payloads or accessed sensitive files.