Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

China-Linked Groups Exploited Chrome Patch Gap to Target NGOs

Part of the CVE-2026-85046 story · since 3 Sep

Quiet for 5 weekslast report 24 Sep26 articles6 outlets
3 Sep · SecurityOnline first4 Oct14 OctNowThis article25th of 26
  • Thu 3 Sep, 23:25 UTC. SecurityOnline, first report. Google Rushes Out Chrome Patch for Exploited V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 04:35 UTC. SecurityOnline. OpenAI Drops Long Context Charges for GPT-6 Astra in Codex. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 08:41 UTC. The Hacker News, its first report on the story. Google Patches Chrome Zero Day Exploited in V8 Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Sneaky 2FA Phishing Campaign Targets Healthcare with AiTM Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Microsoft Teams Vishing Campaign Tricks 150 Workers Into Malware Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. AWS Root Accounts Hit in Password Spraying Campaign Across 150 Firms. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:51 UTC. Security Affairs, its first report on the story. Google Patches Actively Exploited Chrome V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:35 UTC. SecurityOnline. FreeSWITCH api-chat Flaw Exploited via SIP Messages on FusionPBX. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:36 UTC. SecurityOnline. Trezor Warns 80,000 Customers After ShipMonk Data Breach. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 12:10 UTC. SecurityWeek, its first report on the story. Google Patches Chrome V8 Zero Day Exploited in the Wild. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 19:11 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Google Chrome V8 Flaw as High Risk. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Warns of Actively Exploited Chromium Flaw Allowing Code Execution. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Flags Chrome V8 Flaw Affecting Major Chromium Browsers. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 23:57 UTC. Security Affairs. CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 11:46 UTC. SecurityOnline. Google Expands Gemini Live Voice Features Across Workspace Apps. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. SecurityOnline. US Offers $10 Million Reward for IRGC Cyber Commander Yaryab. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 04:31 UTC. SecurityOnline. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 16:08 UTC. The Hacker News. Google Patches Chrome V8 Zero Day Exploited in Active Attacks. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 12:26 UTC. SecurityOnline. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 20:00 UTC. The Hacker News. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 21:06 UTC. Ars Technica, its first report on the story. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 07:00 UTC. Security Affairs. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 17:25 UTC. SecurityOnline. Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived. Cites a CVE in CISA KEV.
  • Sat 12 Sep, 11:30 UTC. SecurityWeek. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 11:30 UTC. Security Affairs. China-Linked Groups Exploited Chrome Patch Gap to Target NGOs. Cites a CVE in CISA KEV. This article, 25th of 26.
  • Thu 24 Sep, 09:59 UTC. SecurityOnline. Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attacks. Cites a CVE in CISA KEV.

Two China-linked threat groups used the same Chrome and Windows exploit chain against non-governmental organisations (NGOs), according to Volexity. The activity began on 1 September 2026, when UTA0560 sent spear-phishing emails directing targets through a legitimate US university website. Attackers exploited cross-site scripting on that site to redirect visitors to their own infrastructure.

Victims were shown a convincing donation form, while the attackers used the page to deliver a multi-stage exploit involving Chrome CVE-2026-85046, a V8 sandbox escape (CVE-2026-87491) and a Windows kernel flaw (CVE-2026-85880).

The exploit gained arbitrary read/write access in the V8 sandbox, escaped Chrome’s sandbox and injected code into the browser process. Volexity found byte-for-byte identical shellcode in UTA0560 activity and campaigns attributed to JungleBamboo, also known as APT31, Violet Typhoon or TA412. The groups used different infrastructure and payloads: UTA0560 deployed the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo used SUPERSTOMP to install the LONGTALE Chrome extension.

Masquerading as a Google Gemini assistant, LONGTALE logged keystrokes, stole cookies and session tokens, and captured screenshots based on command-server keywords.

CVE-2026-85046 had already been fixed in Chromium’s source code after being reported on 4 August, but Google Chrome had not yet shipped the fix when exploitation began, creating what Volexity called a patch gap. Google addressed it on 3 September in Chrome 152.0.7977.82 or .83, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 4 September, with an 18 September remediation deadline for federal systems. Volexity assesses with low confidence that the exploit chain may have been supplied to multiple Chinese operators.

How the story developed

All 26 articles
Quiet for 5 weekslast report 24 Sep26 articles6 outlets

26 articles from 6 outlets since 3 Sep. Quiet since 24 Sep. This was the 25th report, 12 days after the first.

Now3 Sep791113151719212325First reportSecurityOnline · 3 Sep, 23:25This article25th of 26 · day 12CISA alert4 Sep, 19:11 · official
  • Thu 3 Sep, 23:25 UTC. SecurityOnline, first report. Google Rushes Out Chrome Patch for Exploited V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 04:35 UTC. SecurityOnline. OpenAI Drops Long Context Charges for GPT-6 Astra in Codex. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 08:41 UTC. The Hacker News, its first report on the story. Google Patches Chrome Zero Day Exploited in V8 Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Sneaky 2FA Phishing Campaign Targets Healthcare with AiTM Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Microsoft Teams Vishing Campaign Tricks 150 Workers Into Malware Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. AWS Root Accounts Hit in Password Spraying Campaign Across 150 Firms. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:51 UTC. Security Affairs, its first report on the story. Google Patches Actively Exploited Chrome V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:35 UTC. SecurityOnline. FreeSWITCH api-chat Flaw Exploited via SIP Messages on FusionPBX. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:36 UTC. SecurityOnline. Trezor Warns 80,000 Customers After ShipMonk Data Breach. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 12:10 UTC. SecurityWeek, its first report on the story. Google Patches Chrome V8 Zero Day Exploited in the Wild. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 19:11 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Google Chrome V8 Flaw as High Risk. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Warns of Actively Exploited Chromium Flaw Allowing Code Execution. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Flags Chrome V8 Flaw Affecting Major Chromium Browsers. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 23:57 UTC. Security Affairs. CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 11:46 UTC. SecurityOnline. Google Expands Gemini Live Voice Features Across Workspace Apps. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. SecurityOnline. US Offers $10 Million Reward for IRGC Cyber Commander Yaryab. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 04:31 UTC. SecurityOnline. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 16:08 UTC. The Hacker News. Google Patches Chrome V8 Zero Day Exploited in Active Attacks. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 12:26 UTC. SecurityOnline. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 20:00 UTC. The Hacker News. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 21:06 UTC. Ars Technica, its first report on the story. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 07:00 UTC. Security Affairs. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 17:25 UTC. SecurityOnline. Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived. Cites a CVE in CISA KEV.
  • Sat 12 Sep, 11:30 UTC. SecurityWeek. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 11:30 UTC. Security Affairs. China-Linked Groups Exploited Chrome Patch Gap to Target NGOs. Cites a CVE in CISA KEV. This article, 25th of 26.
  • Thu 24 Sep, 09:59 UTC. SecurityOnline. Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 26 articles as a list
  1. Thu 3 SepDay 01
    1. Google Rushes Out Chrome Patch for Exploited V8 Zero Day23:25 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
  2. Fri 4 SepDay 113
    1. OpenAI Drops Long Context Charges for GPT-6 Astra in Codex04:35 · SecurityOnline · Known exploited CVE
    2. Google Patches Chrome Zero Day Exploited in V8 Attacks08:41 · The Hacker News · Known exploited CVE
    3. CISA Flags Actively Exploited Google Chrome V8 Flaw as High Risk19:11 · CISA · official · CISA alert · Known exploited CVE
    Show 10 more from 4 Sep
    1. Sneaky 2FA Phishing Campaign Targets Healthcare with AiTM Attacks09:16 · SecurityOnline · Known exploited CVE
    2. Microsoft Teams Vishing Campaign Tricks 150 Workers Into Malware Attacks09:16 · SecurityOnline · Known exploited CVE
    3. AWS Root Accounts Hit in Password Spraying Campaign Across 150 Firms09:16 · SecurityOnline · Known exploited CVE
    4. Google Patches Actively Exploited Chrome V8 Zero Day09:51 · Security Affairs · Known exploited CVE
    5. FreeSWITCH api-chat Flaw Exploited via SIP Messages on FusionPBX11:35 · SecurityOnline · Known exploited CVE
    6. Trezor Warns 80,000 Customers After ShipMonk Data Breach11:36 · SecurityOnline · Known exploited CVE
    7. Google Patches Chrome V8 Zero Day Exploited in the Wild12:10 · SecurityWeek · Known exploited CVE
    8. CISA Warns of Actively Exploited Chromium Flaw Allowing Code Execution21:01 · CISA · official · Known exploited CVE
    9. CISA Flags Chrome V8 Flaw Affecting Major Chromium Browsers21:01 · CISA · official · Known exploited CVE
    10. CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day23:57 · Security Affairs · Known exploited CVE
  3. Sat 5 SepDay 22
    1. Google Expands Gemini Live Voice Features Across Workspace Apps11:46 · SecurityOnline · Known exploited CVE
    2. US Offers $10 Million Reward for IRGC Cyber Commander Yaryab17:01 · SecurityOnline · Known exploited CVE
  4. Mon 7 SepDay 42
    1. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws04:31 · SecurityOnline · Known exploited CVE
    2. Google Patches Chrome V8 Zero Day Exploited in Active Attacks16:08 · The Hacker News · Known exploited CVE

  5. Quiet for 2 days

    Wed 9 SepDay 63
    1. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days12:26 · SecurityOnline · Known exploited CVE
    2. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows20:00 · The Hacker News · Known exploited CVE
    3. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws21:06 · Ars Technica · Known exploited CVE
  6. Thu 10 SepDay 72
    1. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns07:00 · Security Affairs · Known exploited CVE
    2. Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived17:25 · SecurityOnline · Known exploited CVE

  7. Quiet for 2 days

    Sat 12 SepDay 91
    1. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge11:30 · SecurityWeek · Known exploited CVE

  8. Quiet for 3 days

    Tue 15 SepDay 121
    1. China-Linked Groups Exploited Chrome Patch Gap to Target NGOs11:30 · Security Affairs · Picked up again · Known exploited CVE · This article, 25th of 26

  9. Quiet for 9 days

    Thu 24 SepDay 211
    1. Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attacks09:59 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in