Malware · Vulnerabilities · Threat Intelligence
Hackers Exploit Chrome and Windows Flaws to Target NGOs and Governments
Chinese-linked groups used a chain of Chrome and Windows zero-day vulnerabilities to deliver malware to NGOs and government targets. The attacks exploited a patch gap before official Chrome updates.
Ross GrantUpdated 3 min read
The short version
Hackers found a way to break into computers by combining flaws in Google Chrome and Microsoft Windows. They sent targeted emails to NGOs and government staff, tricking them into clicking links that led to malware. The attack worked because the flaws were fixed in the code but not yet in the official Chrome update, giving hackers a window to exploit. This shows why keeping software up to date is important.
What happened?
Chinese-linked hackers used a chain of three zero-day vulnerabilities in Google Chrome and Microsoft Windows to attack NGOs and Asian government entities in early September 2026. The attackers sent spear-phishing emails with links that exploited a patch gap before Chrome was updated. Malware including GRIMWEDGE and CLEANGULP was delivered. Only secondary sources have reported this so far.
Who was targeted and how
According to The Hacker News (opens in a new tab), multiple Chinese-linked threat actors used a chain of previously unknown vulnerabilities (zero-days) in Google Chrome and Microsoft Windows to attack non-governmental organisations (NGOs) and Asian government entities in early September 2026. The attacks started with spear-phishing emails. These emails encouraged recipients to click links that appeared to lead to legitimate sites, such as a US university or well-known media outlets. In reality, the links abused a vulnerability on those sites to redirect victims to attacker-controlled infrastructure hosting the exploit chain.
The attackers, tracked as UTA0560 and UTA0565 by security firm Volexity, used different lures. One campaign impersonated the Center for American Progress and referenced Hong Kong activist Chow Hang-tung, while another targeted NGOs with links to a university website. The attackers used fake websites and spoofed domains to make their emails look convincing.
The exploit chain: three zero-days
The attacks relied on three vulnerabilities: two in Chrome (CVE-2026-85046 and CVE-2026-87491) and one in Windows Advanced Local Procedure Call (ALPC) (CVE-2026-85880). The chain allowed the attackers to break out of the browser's security sandbox and run code on the victim's computer. According to Volexity, the process began with a reflected cross-site scripting (XSS) flaw that redirected the user to the exploit. The first Chrome bug allowed arbitrary read and write access in the browser's V8 JavaScript engine. The second Chrome bug enabled escaping the browser sandbox. The Windows bug then allowed the attackers to inject code into the Chrome process and achieve remote code execution.
This exploit chain was used to deliver different types of malware, including GRIMWEDGE and CLEANGULP. GRIMWEDGE is a backdoor that lets attackers survey the infected system, manage files and processes, run commands, and download more malicious tools. CLEANGULP, delivered in a separate campaign, supports similar capabilities and uses a command-and-control server that mimics a legitimate media outlet.
Patch gap and zero-day exploitation
One key detail is the timing of the attacks. The vulnerabilities had been fixed in the open-source Chromium codebase, but the patches had not yet reached the stable release of Google Chrome. This created a 'patch gap', a window where attackers could exploit the flaws before most users received the updates. Chrome's release cycle at the time was four weeks for major updates, which has since been shortened to two weeks. The attackers appear to have moved quickly to take advantage of this gap.
Volexity also observed that at least two separate Chinese threat groups used the same exploit chain around the same time. This suggests the exploit kit may have been shared or sold within the Chinese cyber espionage community.
What Google and Microsoft have said
As of now, there are no public statements from Google or Microsoft about these specific attacks or the vulnerabilities involved. The reporting comes from Volexity's research, as covered by The Hacker News. The full scope of the attacks is not yet known, and it is possible that more organisations were affected than have been reported so far.
What users and defenders should do
For ordinary users, the main defence is to keep browsers and operating systems updated as soon as patches are released. Organisations should monitor for suspicious emails, especially those with links to unexpected websites, and consider using web filtering to block known malicious domains. Security teams should review logs for signs of exploitation and check for the presence of the malware families mentioned (GRIMWEDGE, CLEANGULP, or the LONGTALE Chrome extension). The case also highlights the importance of monitoring for patch gaps and understanding the risks they pose.
What is still unclear
These reports are based on secondary sources and have not yet been confirmed by Google or Microsoft. The exact number of affected organisations, the full impact, and whether the exploit chain is still being used remain unknown. The situation may change as more information becomes available.
Claimed vs confirmed
- Unconfirmed
Chinese-linked hackers exploited Chrome and Windows zero-days to deliver malware to NGOs and governments.
Reported by The Hacker News citing Volexity research; not yet confirmed by Google or Microsoft.
- Unconfirmed
Multiple Chinese threat groups used the same exploit chain at the same time.
Volexity observed two groups (UTA0560, UTA0565) using the same chain, suggesting sharing or sale of the exploit kit.
The impact
- Money
- There are no public figures for losses or costs. If confirmed, affected organisations could face costs for incident response and, in some jurisdictions, possible fines for data breaches (for example, up to £17.5m or 4% of global turnover under UK GDPR).
- Reputation
- The attacks targeted trusted NGOs and government entities, which could damage trust if sensitive data was accessed or systems compromised. The use of convincing phishing lures increases reputational risk for both the targets and the spoofed organisations.
- Customers
- Anyone using Chrome and Windows could be at risk during a patch gap. Users should update software promptly and be cautious with unexpected emails and links.
Why it matters
The attacks targeted NGOs and government entities, showing that even patched vulnerabilities can be dangerous if updates are not yet released. Anyone using Chrome and Windows could be at risk during a patch gap. The incident highlights the need for fast patching and vigilance against phishing.
How does it work?
Attackers chained two Chrome vulnerabilities (CVE-2026-85046, CVE-2026-87491) and one Windows ALPC flaw (CVE-2026-85880) to break out of the browser sandbox and run code on victims' computers. The attack began with a spear-phishing email containing a link to a legitimate site with a cross-site scripting (XSS) flaw, which redirected the victim to the exploit. The exploit chain allowed remote code execution and malware delivery before official Chrome patches were released.
Key points
- Attackers exploited three zero-day flaws in Chrome and Windows to deliver malware.
- The attack targeted NGOs and Asian government entities via spear-phishing emails.
- A patch gap allowed exploitation before Chrome users received updates.
- Multiple threat groups used the same exploit chain, suggesting it was shared or sold.
- The full impact and number of victims remain unclear, and only secondary sources have reported it.
Sources
The Hacker News
Reference
