.jpeg)
A phishing email does not always need to send you to a suspicious website.
Sometimes, the website looks legitimate.
Security researchers have identified a China-linked threat actor, tracked as UTA0560, using a chain of Chrome and Windows vulnerabilities to turn a simple phishing link into a full endpoint compromise.
The campaign targets organizations, including NGOs and uses legitimate websites as part of the attack path. Once a victim follows the link, attackers can exploit Chrome, escape its security sandbox, exploit Windows and ultimately deploy a backdoor called GRIMWEDGE.
The attack can be summarized as:
Phishing Link → Legitimate Website → Chrome Exploitation → Sandbox Escape → Windows Exploitation → GRIMWEDGE
How Does the Attack Work?
The attack starts with a targeted phishing email containing a link.
Instead of directing the victim straight to an obviously malicious domain, the attackers have used legitimate websites affected by reflected XSS vulnerabilities. This helps hide the malicious activity behind a website the victim may already trust.
Once the victim reaches the attacker's infrastructure, the exploit chain targets Chrome's V8 JavaScript engine.
Two Chrome vulnerabilities are involved:
- CVE-2026-85046 – provides arbitrary read/write capabilities within the browser.
- CVE-2026-87491 – allows the attackers to escape Chrome's sandbox.
The attackers then exploit CVE-2026-85880, a Windows ALPC vulnerability, to achieve code execution.
In other words, the browser is not just being attacked. It is being used as the bridge into the Windows endpoint.
What Happens After Chrome Is Compromised?
The attackers deploy GRIMWEDGE, a JavaScript-based backdoor. The malware can perform activities such as:
- Host and system reconnaissance
- Process discovery
- File manipulation
- Command execution
- Delivery of additional payloads
This gives attackers a foothold from which they can continue operating on the compromised system.
Why This Attack Is Interesting
Modern browsers are heavily sandboxed. Even when an attacker finds a browser vulnerability, security boundaries are designed to limit what they can do next.
This campaign gets around those boundaries by chaining vulnerabilities together.
One vulnerability compromises the browser.
Another breaks out of the sandbox.
A Windows vulnerability then helps turn that access into code execution.
This is a reminder that attackers do not always need one critical vulnerability that does
What Should Security Teams Watch For?
Security teams should look beyond the phishing email itself and investigate what happens after the user clicks. Watch for:
- Unusual Chrome outbound connections or redirects
- Chrome spawning unexpected processes
- Suspicious JavaScript activity
- Process injection or abnormal memory activity
- Files created shortly after browser activity
- Command-line execution originating from browser activity
- Suspicious endpoint activity following interaction with a phishing link
Recommendations
- Patch Chrome: Ensure all Chrome installations are updated to the latest security release, prioritizing internet-facing and high-value endpoints.
- Patch Windows: Apply the relevant security updates addressing CVE-2026-85880.
- Monitor browser activity: Investigate unusual Chrome processes, redirects, network connections and code-execution behaviour.
- Review EDR telemetry: Search for process injection, unexpected child processes and suspicious activity immediately following browser execution.
- Treat legitimate websites with caution: A familiar domain does not automatically mean the entire browsing session is safe.
- Correlate security data: Combine email, DNS, proxy and endpoint logs when investigating suspicious links or browser activity.
- Investigate exposed endpoints: Review systems where users interacted with suspicious links for signs of exploitation or GRIMWEDGE activity.
- Keep users alert: Remind employees that a phishing attack can begin with a link that looks completely legitimate.
.png)
.png)
.png)