Chrome Zero-Day Exploit Chain Installs GRIMWEDGE Backdoor

On September 1, 2026, security firm Volexity attributed a spear-phishing campaign to a threat actor linked to China and tracked as UTA0560. The emails encouraged recipients at multiple non-governmental organizations to click a link that led to a United States university website. That legitimate site had a reflected cross-site scripting flaw, also called reflected XSS, which the attackers used to redirect visitors to infrastructure they controlled. From there, a multi-stage exploit chain delivered a malicious JavaScript backdoor called GRIMWEDGE.

The exploit chain combines three separate vulnerabilities. Two are in Google Chrome and one is in Microsoft Windows Advanced Local Procedure Call, or ALPC. The first, CVE-2026-85046, allows arbitrary read and write access inside the V8 sandbox, a security boundary within Chrome. The second, CVE-2026-87491, escapes the browser sandbox. The third, CVE-2026-85880, injects code into the Chrome browser process so the attacker can run arbitrary code on the machine. Proofpoint had previously documented this chain, and Volexity notes that the final exploit page filters out systems that are not running Chrome on Windows. The chain is also referred to as BlueMoon. The last page contains three binary payloads encoded as Base64 strings inside JavaScript: p1 performs host reconnaissance and fingerprinting, p2 carries out Windows kernel privilege escalation, and pp performs browser process injection and downloads the next payload.

For UTA0560, that next payload is an executable named msgbox.exe. It acts as a loader that extracts a legitimate Windows binary and a malicious DLL called wsc.dll from itself, then starts a DLL side-loading chain. The DLL contacts the same server and fetches a text file whose name matches the hostname of the compromised device. That text file is an MSI installer designed to run an obfuscated JavaScript backdoor contained in its custom actions. Once launched, GRIMWEDGE begins a persistent command loop that polls a command-and-control server, ocr.opusaccel[.]top, and then executes instructions in memory using the eval() command. It understands commands such as Info for system reconnaissance, Dir for directory listings, Mkdir to create a directory, Del to delete a file, Tasklist to list running processes, Taskkill to stop a process, Type to read files up to 5 MB, Run to execute a command in a hidden window, and Upload to receive files in chunks and commit them to disk. The researchers state that the code has no built-in persistence, lateral movement, or exfiltration mechanism beyond reading files and uploading them, so it provides only an initial foothold.

Volexity also observed a second threat actor with links to China, JungleBamboo, also known as APT31, using the same Chrome-Windows chain around the same time. JungleBamboo deployed a loader named SUPERSTOMP, which then installed LONGTALE from a remote server. LONGTALE is a credential-stealing Chrome extension that masquerades as a Google Gemini extension with the ID ckiknalbeplpcpofpnabcnhjcegckfei. Its capabilities include keylogging, form capture, cookie and session theft, screenshot capture based on C2-supplied keywords, bulk exfiltration of keystrokes, cookies, storage data, navigation history, and session metadata roughly every 30 seconds, and remote command and control. Volexity notes that LONGTALE lacks even a basic remote code execution command, and suggests the attackers may have considered the extensive information-theft features sufficient for their credential theft and surveillance goals. The near-simultaneous use of the same chain by two groups raises the possibility that the exploit developer sold or shared it after reverse-engineering changes in the Chromium source code.

One particularly unusual aspect is the patch gap. The fixes for the two Chrome flaws were pushed to the open-source Chromium codebase but had not yet been incorporated into a stable release of Google Chrome. This made them N-day bugs, meaning they were known and fixed upstream, but still zero-days against the product people actually use. Because Chrome had a four-week release cycle for major milestones until last week, when it changed to every two weeks, the attackers likely moved quickly to exploit the window before official patches reached users. Volexity warns that patch-gap vulnerabilities present an even greater risk because they create extra time for exploitation, and notes that large language models are becoming more useful for rapid vulnerability research and exploit development. For website owners and businesses, this is a reminder that keeping browsers and operating systems updated is not enough if a vendor's patch lags behind an open-source fix. For organizations that want help closing patch gaps and tightening endpoint security, AEU-I provides security-first IT and infrastructure consulting.