Chrome Zero-Day Attack: APT31 Exploits Patch Gap, Google Patches in 48 Hours

On September 1, 2026, China-linked threat actors launched spear-phishing campaigns against non-governmental organizations exploiting a chain of three vulnerabilities — two in Chrome, one in Windows — that Google had not yet patched in the browser's stable release. UTA0560 and the JungleBamboo cluster (attributed to APT31) exploited the so-called patch gap: the lag between a fix appearing in the open-source Chromium repository and its delivery to users via Chrome stable.

The Patch Gap: When Transparency Becomes a Weapon

On August 4, 2026, researcher Salvatore Gulizia reported CVE-2026-85046, a type confusion in the V8 engine, to Chromium. The fix landed in the project's public repository, but Google did not immediately release a stable Chrome version. An exposure window — the patch gap — emerged during which the fix code was visible to anyone, while users remained vulnerable.

Volexity, the threat intelligence firm that analyzed the UTA0560 campaign, documented this condition precisely: the vulnerability was "known and fixed upstream, making it an N-day at the Chromium source level, but no patch release existed for Google Chrome users." On September 1, 2026, when spear-phishing emails began hitting NGOs, Chrome stable still lacked the fix. Google shipped version 152.0.7977.82/.83 only on September 3, two days after the attacks began.

This dynamic turns an architectural principle — open-source transparency — into an intelligence vector for attackers. The Chromium source code allows analysis of fix diffs, reconstruction of the original vulnerability, and development of working exploits before most users receive protection.

The Technical Chain: From Browser to Windows Kernel

The BlueMoon exploit kit used in the campaigns documented by Volexity and Proofpoint chained three distinct phases. CVE-2026-85046 provided initial access through a type confusion in Chrome's V8 JavaScript engine. From there, CVE-2026-87491 — an out-of-bounds write in the WebAssembly component with a CVSS 8.8 per the NVD record — enabled escape from the browser sandbox. The third phase, CVE-2026-85880, exploited a heap-based buffer overflow in the Windows ALPC (Advanced Local Procedure Call) subsystem to elevate privileges to SYSTEM, completing compromise of the target machine.

According to Microsoft's official advisory, CVE-2026-85880 carries a CVSS 3.1 score of 7.8 and was detected in active exploitation. The transition from the browser process to the Windows kernel represents the critical pivot that transforms a web compromise into full endpoint control.

The exploit kit displayed sophisticated operational characteristics: 13 URL parameters for testing, breakpoints, telemetry, and controlled rollout; an automatic retry mechanism with five attempts to handle recoverable failures in the exploit Web Worker. Proofpoint also noted unusual patterns in the JavaScript code — extensive diagnostic logging, verbose comments, repeated references to v8CTF — suggesting possible LLM-assisted development, or at least a structure designed to evade LLM guardrails.

Two Actors, Same Code: Sharing or Market?

The UTA0560 and JungleBamboo campaigns shared shellcode identical byte-for-byte, according to Volexity and cited by SecurityAffairs. This technical overlap indicates the exploits were not developed independently: Volexity assesses with low confidence that the code was sold, and with medium confidence that it stems from a shared developer.

UTA0560 deployed GRIMWEDGE, a JScript backdoor that resides in memory via msiexec.exe and connects to the command-and-control server ocr.opusaccel[.]top. The payload is compact — under 250 lines — and implements commands for process listing, execution, chunked upload, and arbitrary code evaluation via eval(). Volexity explicitly noted that "the code lacks persistence, lateral movement, or integrated exfiltration mechanisms beyond file read and upload commands." The absence of advanced features suggests a minimalist design, perhaps to reduce detectable footprint or to operate in environments where initial access suffices for the assigned role.

JungleBamboo took a different post-exploitation path: it used SUPERSTOMP to install LONGTALE, a Chrome extension posing as Google Gemini (ID: ckiknalbeplpcpofpnabcnhjcegckfei). LONGTALE captures screenshots triggered by specific keywords, steals credentials, and monitors sessions. Here too Volexity noted a significant limitation: "LONGTALE lacks even a basic remote code execution command that would allow the actor to conduct additional post-exploitation activities." Both payloads are functionally circumscribed, almost modular in their specialization.

The Extension That Survives Restarts: GhostChrome-X

The GhostChrome-X technique, detailed by SecurityAffairs, allows LONGTALE to survive Chrome closure and reopening despite the extension integrity mechanisms Google introduced. SUPERSTOMP strips cryptographic hashes of installed extensions and forges legacy HMAC values, deceiving the checks that should block modified or unauthorized extensions.

This technique appeared publicly on August 6, 2026, on a popular GitHub repository, according to sources. Its operational adoption by September indicates a rapid development-to-adoption cycle, typical of environments where open-source research is immediately weaponized. The extension's persistence in the user profile — not the operating system — renders it invisible to many endpoint protection tools focused on machine-level indicators of compromise.

Immediate Actions

Organizations managing Windows endpoints with Chrome must verify update to version 152.0.7977.82 or later, released September 3, 2026, which patches CVE-2026-85046. CISA added this vulnerability to the KEV catalog on September 4 with a federal deadline for U.S. government agencies set for September 18, 2026; the same sources indicate CVE-2026-85880 and CVE-2026-87491 were also included in the catalog with respective deadlines.

Indicator-of-compromise hunting must include the domain ocr.opusaccel[.]top associated with GRIMWEDGE and the extension ID ckiknalbeplpcpofpnabcnhjcegckfei for LONGTALE. SHA-256 hashes of sampled variants are available in GBHackers reports and Volexity analyses.

Verification of installed Chrome extensions in the user profile is a priority: GhostChrome-X modifies extension state files in the profile path, not in the registry or centralized installation directories. A check comparing active extensions against the organization's approved inventory can detect anomalies.

Organizations exposed to spear-phishing risk — particularly NGOs and political research institutes — should evaluate web access segmentation: the exploit chain requires interaction with a malicious link in Chrome on Windows, so isolating web browsing from systems holding sensitive data reduces the attack surface against the primary vector.

"Patch-gap vulnerabilities present an even greater risk, as they create an additional time window for threat actors conducting exploitation campaigns" — Volexity (via SecurityAffairs)

Four Groups, One Week, Same Kit

The operation's scope exceeds the two initial clusters. Proofpoint identified four distinct groups using BlueMoon in a compressed window: APT31 (JungleBamboo) from August 28, UNK_LateNight and UNK_DoubleCheck on September 2, UNK_QuietRacket on September 3. This temporal concentration of different actors around the same toolkit raises questions about the exploit market structure feeding them — a market that, per Proofpoint, AI may make accessible to a broader audience: "This may reflect a reduced cost and lower barrier to entry for this class of capability, as AI agents increasingly enable exploit development by threat actors."

Proofpoint's assessment includes a margin of uncertainty: it is unclear whether AI was actually employed in development or whether the observed linguistic characteristics are framing techniques to bypass language model guardrails. The dossier does not resolve this ambiguity.

An Attack Model That Will Repeat

The Chromium patch gap is not an isolated incident but a structural condition. The world's most widely used browser's open-source development model publishes fixes in real time, while the stable channel — used by the vast majority of enterprise users — follows more conservative release cycles. This asynchrony creates measurable vulnerability windows of days or weeks, during which attackers with reverse-engineering capability can reconstruct the original flaw and build working exploits.

The September 2026 campaign demonstrates that state-aligned actors are systematically exploiting this window. The open question — which the dossier does not answer — is whether other groups will adopt this TTP as standard operating procedure or whether the patch gap will remain primarily in the hands of actors with resources for rapid research on public commits.

The most concerning indicator is not technical but organizational: the sharing of identical exploits across different clusters, the compression of time between a public technique's appearance and its operational use, the presence of four groups around the same kit in seven days. These elements suggest a development and distribution ecosystem maturing faster than traditional organizational defenses.

Sources

• https://thehackernews.com/2026/09/china-linked-hackers-exploit-chrome.html
• https://blog.talosintelligence.com/clickfix-moves-into-the-browser/
• https://securityonline.info/chrome-zero-day-exploit-chain/
• https://thomasharris6.wordpress.com/2026/09/15/china-linked-hackers-exploit-chrome-windows-zero-day-chain-to-deploy-grimwedge/
• https://securityaffairs.com/199104/apt/one-exploit-chain-two-espionage-campaigns-chrome-and-windows-under-fire.html
• https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/
• https://cyberpress.org/chinese-hackers-chain-chrome-and-windows-zero-days/
• https://nvd.nist.gov/vuln/detail/cve-2026-87491
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880
• https://github.com/asaurusrex/Silent_Chrome/commit/814fa9c2b75f95b8140ea6d460877772a2d4d507
• https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html
• https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html