China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A Chinese threat actor has been linked to a spear-phishing campaign that exploits security flaws in Google Chrome and Microsoft Windows to deploy a malicious JavaScript backdoor called GRIMWEDGE. The campaign targeted multiple non-governmental organizations. The threat actor, tracked as UTA0560 by Volexity, took advantage of recently patched vulnerabilities in Chrome and Windows. The activity was observed on September 1, 2026. The exploited flaws were in Chrome and Windows, which have since been patched.