Volexity caught two Chinese actors, UTA0560 and JungleBamboo, firing the same Chrome chain at separate targets, NGOs among them, by 1 September: a V8 type confusion (CVE-2026-85046), a WebAssembly sandbox escape (CVE-2026-87491), and a Windows kernel privilege escalation (CVE-2026-85880).
Each dropped a different payload: the GRIMWEDGE backdoor or the LONGTALE credential-stealing extension.
The nasty part is the patch gap: the bug was reported on 4 August and fixed in Chromium source on 7 August, but stable Chrome only shipped it on 3 September, so it stayed a zero-day for anyone reading public commits, and the exploit was built between 27 and 29 August.
The V8 bug’s reporter even published a writeup on 28 August, while stable Chrome was still unpatched.
Proofpoint tracks the same kit as BlueMoon and watched it proliferate: TA412 first on 28 August, then UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket within a week, with signs of AI-assisted development and a rushed rollout that prioritised speed over OPSEC.
Default deployments leave a process tree of chrome.exe → cmd.exe → curl.exe → msgbox.exe, which is less an indicator of compromise than a confession.
