China-Linked Hackers Chain Chrome Zero

Gbhackers •Eswar • September 12, 2026

China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims. Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

China-Linked Hackers Target NGOs with Chrome and Windows Exploits On September 1, 2026, Chinese threat actors UTA0560 and JungleBamboo executed phishing campaigns targeting NGOs, exploiting zero-day vulnerabilities in Google Chrome and Microsoft Windows. The attack utilized a spear-phishing email that redirected victims to a compromised U.S.-based university website, leveraging a reflected XSS vulnerability. The exploit chain involved three CVEs: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880, allowing attackers to gain arbitrary code execution and install the GRIMWEDGE backdoor. This malware facilitates host reconnaissance and command execution, polling a command-and-control server for further instructions. Volexity documented these operations, highlighting the use of sophisticated multi-stage exploits. The attacks were confirmed to be in progress, with active exploitation reported. 2 sources 78

Extracted Entities

China-Linked Hackers Chain Chrome Zero

The full story

Extracted Entities

APT Groups (2)

Attack Types (3)

Countries (1)

CWE Weaknesses (1)

Malware (2)

MITRE ATT&CK (5)

Platforms (1)

Tools (1)