Two Chinese actors hit Chrome with byte-identical shellcode before the Chromium fix shipped

Volexity dates one edge of the gap. A private security researcher reported the V8 type confusion to the Chromium project on August 4, 2026 ^[4]. Volexity's network monitoring caught it in use on September 1 ^[1], 28 days later ^[14]. The report says a fix "later entered the open-source Chromium codebase" and gives no date for that commit ^[15]. The interval defenders actually care about, from public fix to shipped Chrome, therefore has no measured width in this evidence. Twenty-eight days is the outer bound on it.

The chain runs three defects in series, one per boundary. The type confusion gives arbitrary read and write inside the V8 sandbox ^[7]. A separate WebAssembly defect, CVE-2026-87491, escapes that sandbox ^[8]. A Windows kernel bug, CVE-2026-85880, then escapes Chrome's sandboxed renderer and injects code into the browser process, after which the operator deploys a payload of choice ^[9]. On Volexity's own ordering the browser fix touches only the first step, and the first step is what the other two ride on. A released Chrome carrying the V8 patch would have broken the chain at stage one ^[6].

Nothing in the report says either actor found the bug by reading Chromium commits. The bug arrived from a private researcher ^[4], and the report does not state whether the WebAssembly defect or the kernel bug were patched upstream at all ^[16]. Volexity says both actors delivered the same multi-stage chain with byte-for-byte identical shellcode, with JungleBamboo hosting identical components on proof.gitprogram[.]com and photos.msbenefit[.]com and serving a different final payload ^[10]. Where those bytes came from, the report does not say.

For anyone defending an NGO mailbox, the reachable surface was the link. It pointed at a legitimate US-based university website carrying a reflected XSS flaw, and that redirect is what delivered the victim to cloud.shinewrist[.]net and the Files1.html landing page ^[2][13]. A user who checked the domain before clicking would have found a real university. The lure itself matched UTA0560 phishing that Volexity had already seen against customer organisations in March 2026, when it failed ^[11]. Once the exploit page loaded, the only thing visible on screen was a decoy image of a donation form built for the targeted organisation ^[12].

Volexity attributes the September campaign to UTA0560 and says it found JungleBamboo, which it also tracks as APT31, Violet Typhoon and TA412, exploiting the same chain against a different set of targets ^[3]. Two distinct activity clusters used the chain to deliver different payloads ^[17].