Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived

Security researchers have traced a Chrome-focused zero-day chain used by two Chinese espionage cohorts, UTA0560 and JungleBamboo (APT31), to target NGOs and public policy institutes across borders. The attackers carried out spear-phishing campaigns delivering links to an educational portal that redirected recipients to a malicious exploit page.

Background scripts loaded the exploit inside a hidden iframe, culminating in a chain that exploited a memory access flaw in the V8 engine (CVE-2026-85046) and a WebAssembly defect (CVE-2026-87491) to break out of the V8 sandbox, followed by a Windows kernel escalation (CVE-2026-85880) to inject code into the main browser process. The operation relied on an upstream Chromium fix that had not yet reached stable Google Chrome releases when the attacks began, creating a notable patch gap.

Volexity’s findings indicate two distinct clusters using the same exploit code but deploying different post-exploitation payloads. UTA0560’s loader created a scheduled task known as Windows Scheduled System to achieve persistence, then ran GRIMWEDGE, a memory-resident JScript backdoor capable of enumerating settings, processes, and executing commands, with file uploads as needed.

JungleBamboo deployed a loader named SUPERSTOMP that manipulated Secure Preferences to install a rogue Chrome extension called LONGTALE, masquerading as Google Gemini; this extension captured keystrokes, harvested session cookies, and took targeted screenshots, without requiring direct system commands.

Organisations should apply the Chrome/Chromium patch immediately, verify Windows builds are current, monitor for unusual scheduled tasks, audit browser extensions, and watch for anomalous beaconing to unverified domains.