Two China-linked crews, one Chrome chain, and a fake Gemini extension

Browser updates feel automatic until they are not. Volexity published research on September 15 describing two China-linked groups using the same three-stage exploit chain against NGOs. One dropped a JavaScript backdoor called GRIMWEDGE. The other installed a Chrome extension dressed up as Google Gemini. The shared trick was a Chrome bug that was fixed in Chromium source before it shipped in Chrome Stable.

The chain in plain language

Volexity tracks the first cluster as UTA0560. Activity against multiple NGOs started around September 1 with spear-phishing that led into Chrome. The core browser issue is CVE-2026-85046, which gives arbitrary read and write inside the V8 sandbox. The next hop is a Windows ALPC elevation, CVE-2026-85880, the same class of bug Microsoft patched in the record September Patch Tuesday. Together they escape the browser sandbox and run code in the Chrome process.

A private researcher reported the Chrome issue to Chromium on August 4. A fix landed upstream. Google had not yet shipped that fix in a stable Chrome build when the phishing started. That is an ugly gap: N-day in the open-source tree, zero-day against the browser people actually run.

Google pushed CVE-2026-85046 into Chrome Stable on September 3 (152.0.7977.82 and .83). CISA added it to KEV the next day with a September 18 federal deadline. If a workstation has not relaunched Chrome since early September, do not assume it is patched.

Two groups, two payloads

UTA0560 used the chain to deliver GRIMWEDGE, a malicious JavaScript backdoor. Around the same window, JungleBamboo (also tracked as APT31) used matching exploit code against different targets. Same chain, different infrastructure and malware. JungleBamboo dropped a loader Volexity calls SUPERSTOMP, which installs LONGTALE, a credential-stealing extension that pretends to be a Gemini helper. Public reporting listed a Chrome extension ID used in that masquerade. Features include keylogging, cookie and token theft, and screenshots when the command server flags keywords.

Two unrelated China-nexus crews hitting the same fresh chain at the same time usually means the exploit was sold, shared, or reverse-engineered from the Chromium diff. Defenders should assume more than two buyers.

What we would check today

• Confirm Chrome is 152.0.7977.82 or newer on every managed Windows profile. Look at the version string, not the policy that says auto-update is on.
• Apply the September Windows cumulative that covers CVE-2026-85880 if you have not already.
• Audit installed Chrome extensions for unexpected Gemini or assistant clones, including the ID called out in public reporting.
• Review mail and web logs for NGO-style spear-phish from early September if you serve civil society, legal, or policy clients.
• Treat a confirmed GRIMWEDGE or LONGTALE hit as a full identity incident: rotate tokens, review mailbox rules, and assume session cookies are burned.

Bottom line

Upstream patches are not user patches. Espionage groups read Chromium commits. Forensic Five helps Canadian organizations verify browser and Windows patch posture and produce a scoped report boards and insurers can use. From St. Albert, Alberta. No hype, just what is reachable and what to fix first.