Patch Gap Zero Day Chain: Three Chinese Actors Share a Chrome and Windows Kernel Exploit Kit

A spear-phishing campaign detected on September 1, 2026 led to the discovery of a three-stage exploit chain targeting Google Chrome and the Windows kernel. The first Chrome flaw had already been fixed in Chromium source code but had not yet reached a stable Chrome release, creating a window in which the vulnerability was effectively a zero-day for Chrome users while the patch was publicly visible. Investigators assessed with medium confidence that the exploit developer identified the flaw by reverse-engineering that public fix.

The chain begins with a V8 type confusion that provides arbitrary read and write inside the V8 sandbox, followed by a WebAssembly flaw used to escape it and a previously unknown Windows kernel vulnerability used to escape the Chrome renderer sandbox and inject into the browser process. Delivery uses a lure page, an obfuscated JavaScript loader that checks for Chrome on Windows, and a hidden exploit page containing Base64-encoded shellcode for host reconnaissance, kernel privilege escalation, and browser-process injection. The exploit includes retry logic, environment checks, development parameters, and a configurable payload URL, allowing the same core exploit to deliver different malware.

The actors diverged after gaining execution inside the Chrome browser process. One deployed a DLL side-loading chain with scheduled-task persistence, then delivered an MSI-based JScript backdoor that operated in memory and supported reconnaissance, file operations, process control, uploads, and arbitrary execution. A second actor installed the LONGTALE Chrome extension, masquerading as a Google Gemini add-on, to capture keystrokes, form data, cookies, browser storage, and targeted screenshots. LONGTALE had no command-execution capability and instead functioned as a credential and session harvester. The LONGTALE installer bypassed Chrome's extension integrity protections by modifying the profile's `Secure Preferences` file, removing newer encrypted integrity values, inserting the malicious extension, and generating valid legacy authentication codes. Chrome then accepted the forged state and re-signed it under the newer integrity scheme. The actor also hid its command-and-control infrastructure behind Cloudflare Tunnels.

A third actor used the same exploit kit two days later through typosquatted websites that mirrored legitimate content while loading the exploit in a hidden iframe. Its reconnaissance and privilege-escalation stages matched the earlier activity, but the final stage downloaded and launched the implant in-process through the Windows shell rather than using `cmd.exe` and a transfer utility. The implant established scheduled-task persistence and supported command execution, process discovery, file transfer, and beacon object file execution. Additional observations by other vendors indicate that the exploit kit was shared and customized across multiple threat groups rather than being exclusive to a single actor.