The Russia-linked RomCom APT has been observed chaining two zero-days in Firefox and Windows for backdoor delivery.