China-linked APTs Exploit Same Chrome/Windows Flaw to Target NGOs Before Patch Deployment

Two distinct Chinese cyber espionage groups have been identified using an identical zero‑day vulnerability affecting both Google Chrome and Microsoft Windows to infiltrate non‑governmental organizations, security researchers reported. The campaign began on September 1, 2026, and continued until a Chrome update that patched the flaw was released later in the month.

Both threat actors leveraged the same exploit chain, which combined a browser‑side privilege escalation with a Windows kernel vulnerability, allowing them to gain persistent access on victim machines. After the initial compromise, each group deployed its own custom backdoor: one installed a modular remote‑access tool commonly associated with the group known as APT31, while the other used a different payload linked to the APT40 family.

The use of a shared exploit suggests either a direct transfer of tools between the groups or the acquisition of the zero‑day from a common source, such as a market broker. Analysts note that reusing the same chain across separate campaigns is unusual for state‑aligned actors, who typically develop bespoke exploits to avoid detection.

Targeted NGOs span a range of focus areas, including human rights, environmental advocacy, and humanitarian aid. Researchers observed that the attackers prioritized organizations with ties to Western governments or those receiving international funding, indicating an intelligence‑gathering motive rather than financial theft.

Google issued a security update for Chrome on September 28, 2026, which closed the browser component of the chain. Microsoft followed with a patch for the Windows kernel vulnerability in its October security bulletin. Both vendors urged users to apply the updates immediately, noting that the exploit was actively weaponized in the wild.

Cyber‑security firms have warned that remnants of the campaign may persist in networks that missed the patches, especially where older operating systems remain in use. They recommend comprehensive endpoint scanning, removal of the identified backdoors, and a review of privileged account activity to detect any lingering footholds.

While attribution remains focused on Chinese‑linked groups, officials from the affected NGOs have not publicly confirmed breaches. The incidents underscore the ongoing risk that nation‑state actors pose to civil‑society organizations, and they highlight the importance of rapid patch management and layered defenses against sophisticated, multi‑stage attacks.

Going forward, experts anticipate that threat actors will continue to hunt for zero‑day exploits in widely deployed software, exploiting the lag between discovery and patch distribution. Organizations are advised to adopt a “patch‑first” posture, maintain up‑to‑date inventories of software versions, and consider threat‑intelligence feeds that can alert them to emerging exploit chains before they are widely known.