A China-linked threat actor has been observed chaining recently patched Google Chrome and Microsoft Windows vulnerabilities to compromise targets and deploy a JavaScript backdoor called GRIMWEDGE. The campaign targeted multiple non-governmental organizations on September 1, 2026, according to security researchers at Volexity.
The group, tracked as UTA0560, launched the attacks through spear-phishing emails containing links to a legitimate U.S. university website. The attackers abused a reflected cross-site scripting vulnerability on the university’s site to redirect victims toward infrastructure hosting a multi-stage exploit chain.
The exploit chain, known as BlueMoon, combines three vulnerabilities. CVE-2026-85046 provides arbitrary read and write capabilities within Chrome’s V8 sandbox, CVE-2026-87491 enables a sandbox escape, and CVE-2026-85880 exploits Windows Advanced Local Procedure Call functionality to inject code into the Chrome process and achieve arbitrary code execution.
The attackers also fingerprint visitors before delivering the exploits, filtering out systems that are not running Chrome on Windows. Successful targets receive several embedded shellcode payloads responsible for system reconnaissance, Windows privilege escalation, browser process injection and downloading additional malware.
UTA0560 ultimately deploys GRIMWEDGE through a multi-stage loader. An executable calledmsgbox.exeextracts a legitimate Windows binary alongside a maliciouswsc.dllfile, initiating a DLL sideloading chain that eventually installs the JavaScript backdoor.
Once active, GRIMWEDGE repeatedly contacts its command-and-control server for instructions. The malware can collect system information, list directories and running processes, read and delete files, terminate processes, execute commands and download additional payloads.
Researchers said GRIMWEDGE does not contain dedicated persistence, lateral movement or advanced exfiltration capabilities. However, it provides enough functionality for attackers to survey a compromised computer, retrieve valuable files and install additional tools if necessary.
Volexity also observed another China-linked group, JungleBamboo, also known as APT31, using the same BlueMoon exploit chain around the same period. Instead of GRIMWEDGE, this group deployed SUPERSTOMP, which installed a malicious Chrome extension called LONGTALE or GemStone.
LONGTALE masquerades as a Google Gemini extension and focuses heavily on surveillance and credential theft. It can record keystrokes, capture form data, steal cookies and authenticated sessions, take screenshots and exfiltrate browsing information approximately every 30 seconds.
The near-simultaneous use of BlueMoon by multiple Chinese threat actors has raised questions about whether the exploit chain was developed by a third party and distributed or sold to several groups. Researchers have not established exactly how the different actors obtained access to it.
One of the most important aspects of the campaign is the patch gap surrounding the Chrome vulnerabilities. Fixes had already been committed to the open-source Chromium codebase but had not yet reached the stable Google Chrome release, effectively giving attackers information they could potentially use while ordinary Chrome users remained vulnerable.
This creates a dangerous window in which threat actors can analyze upstream security changes, identify the underlying vulnerability and develop an exploit before the corresponding browser update reaches users. Volexity warned that increasingly capable AI tools could make this process faster by helping researchers and attackers analyze patches and develop exploits.
The BlueMoon campaign demonstrates how quickly sophisticated threat actors can turn browser and operating-system vulnerabilities into complete attack chains. For organizations, keeping Chrome and Windows updated remains critical, particularly when attackers are actively combining multiple vulnerabilities to move from a malicious link to full code execution on targeted systems.