A Three-Stage Chain From Inbox to Kernel
Security researchers at Volexity have detailed a spear-phishing campaign by a China-linked threat cluster tracked as UTA0560, which chained three separate Chrome and Windows zero-day vulnerabilities to deliver a custom JavaScript backdoor dubbed GRIMWEDGE. Volexity observed the activity around September 1, 2026, targeting multiple non-governmental organizations (NGOs).
The Exploit Chain
| CVE | Component | Role |
|---|---|---|
| CVE-2026-85046 | Chrome V8 | Sandbox escape enabling arbitrary read/write |
| CVE-2026-87491 | Chrome | Additional browser sandbox escape mechanism |
| CVE-2026-85880 | Windows ALPC | Privilege escalation to the OS level |
The campaign began with phishing emails containing a message encouraging recipients to click a link pointing to the website of a U.S.-based university. That legitimate site carried a reflected XSS vulnerability, which UTA0560 abused to redirect victims to attacker-controlled infrastructure without the link itself needing to point anywhere suspicious.
From there, three Base64-encoded JavaScript payloads executed in sequence:
p1— host reconnaissance and fingerprinting shellcodep2— Windows kernel privilege-escalation shellcode, leveraging the ALPC flawpp— browser process injection and final payload downloader
Inside GRIMWEDGE
The resulting GRIMWEDGE backdoor is JavaScript-based and maintains persistent command-and-control polling against ocr.opusaccel[.]top. It supports a broad command set including system reconnaissance, file operations, process management, and arbitrary command execution via eval() — giving operators effectively unrestricted post-compromise capability on infected hosts.
Volexity also observed a second, unrelated Chinese threat group — JungleBamboo, tracked elsewhere as APT31 — exploiting the same window of activity with separate credential-stealing tooling, suggesting either shared tooling access or independent discovery of overlapping opportunities.
The N-Day Gap Behind the Zero-Days
A key detail in Volexity's analysis is when these bugs stopped being zero-days for defenders versus attackers: upstream Chromium fixes for the underlying issues were committed before Google shipped the corresponding patched Chrome release, creating a window where the vulnerability details were effectively public in the open-source Chromium repository while the majority of Chrome users remained unpatched. Sophisticated actors like UTA0560 are increasingly monitoring upstream open-source commits to weaponize these gaps ahead of official releases.
Recommendations
- Keep Chrome and Windows fully updated — given the N-day exploitation pattern described above, patch as soon as updates are available rather than waiting for a fixed release cycle.
- Treat unsolicited links to otherwise-legitimate sites with caution, especially in phishing campaigns targeting NGOs, policy organizations, and other frequent nation-state targets — a legitimate-looking destination domain does not guarantee a safe redirect chain.
- Monitor for outbound connections to unfamiliar domains following browser activity, particularly from endpoints handling sensitive NGO or advocacy work.
- Web administrators should audit and remediate reflected XSS vulnerabilities on institutional sites — even sites unrelated to the ultimate target can be weaponized as an unwitting redirect layer.