China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

Chinese threat actors, including UTA0560 (linked to JungleBamboo/APT31), are exploiting a Chrome-Windows zero-day chain to deploy GRIMWEDGE, a JavaScript backdoor. The vulnerability stems from a patch gap – while fixes were available in Chromium, they weren't yet integrated into stable Chrome releases. The attackers leveraged a reflected XSS vulnerability to deliver GRIMWEDGE, which allows for host reconnaissance, file management, and payload delivery.

UTA0560 has been observed using this attack method to deploy GRIMWEDGE, which begins with a spear-phishing email containing a link to a legitimate website susceptible to a reflected XSS vulnerability. The exploit chain, also known as BlueMoon, involves three separate flaws – two in Chrome and one in Windows Advanced Local Procedure Call (ALPC). It first abuses CVE-2026-85046 to gain arbitrary read/write within the V8 sandbox, then escapes the browser sandbox via CVE-2026-87491, and finally employs CVE-2026-85880 to inject code into the Chrome browser process and achieve arbitrary code execution.

GRIMWEDGE facilitates host reconnaissance, file and process management, command execution, and payload delivery capabilities. The threat actor is said to have leveraged this flaw to trigger the zero-day exploit chain, also called BlueMoon, to deliver the malware, while filtering out systems not using Chrome on Windows to visit the URL. The final exploit page embeds three binary payloads as Base64-encoded strings within JavaScript - p1, shellcode that reflectively loads a DLL to conduct host reconnaissance and fingerprinting; p2, shellcode that reflectively loads a DLL to facilitate Windows kernel privilege escalation; and pp, shellcode to perform browser process injection and payload download.

In the case of UTA0560, the next-stage payload is an executable named "msgbox.exe," which serves as a loader responsible for extracting from itself a legitimate Windows binary and a malicious DLL ("wsc.dll") to initiate a DLL sideloading chain. The DLL, for its part, contacts the same server to fetch a text file that's named after the device's hostname obtained during the profiling step. The text file is an MSI installer designed to execute an obfuscated JavaScript backdoor contained within the MSI custom actions. Once launched, GRIMWEDGE enters a persistent command loop that polls a command-and-control (C2) server ("ocr.opusaccel[.]top") to receive further instructions that are then executed in memory via the eval() command. It's equipped to parse the following commands - Info, to perform system reconnaissance; Dir, to fetch a directory listing; Mkdir, to create a directory; Del, to delete a file; Tasklist, to enumerate running processes; Taskkill, to kill a process by PID; Type, to read a file up to 5 MB; Run, to execute a command within a hidden window; Upload (chunk), to get a Base64-encoded chunk from the C2 server and append to an in-memory buffer; and Upload (commit), to save the accumulated buffer to disk as the final file.

Volexity said it also observed a second China-nexus threat actor known as JungleBamboo (aka APT31) using the same exploit chain around the same time to deploy a loader named SUPERSTOMP, which then installs LONGTALE, a credential-stealing Chrome extension also referred to as GemStone, from a remote server. It masquerades as a Google Gemini Chrome extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei) to evade detection, while supporting the following features - Keylogging and form capture; Cookie and session theft; Screenshot capture by monitoring page content for keywords supplied by a C2 server; Bulk exfiltration of keystrokes, cookies, storage data, navigation history, and session metadata to the C2 server at roughly 30-second intervals; and Remote command and control.

LONGTALE lacks even a basic remote code execution command that would enable the threat actor to conduct additional post-exploitation activity on compromised devices. The threat actor regarded this feature as unnecessary, as the extensive information-theft capabilities offered by LONGTALE were sufficient to achieve JungleBamboo's credential theft and surveillance objectives.

The near-simultaneous use of the same Chrome-Windows chain by multiple threat actors in China has raised the possibility that it may have been sold, or made available, to them by the exploit developer after possibly reverse-engineering the changes in the Chromium source code.

What's notable here is the patch gap: while the fixes for the two Chrome flaws were pushed to the open-source Chromium codebase, they had not been incorporated into a stable release version of Google Chrome. In other words, the upstream patches created an unusual case of two N-day bugs that were addressed in Chromium, but not in Chrome. This, in turn, made them zero-days against Chrome.