At least 4 Chinese state-aligned hacking groups began exploiting the same zero-day vulnerabilities in Chrome and Windows nearly simultaneously. When Google silently released a patch for a critical Chrome vulnerability, attackers could scrutinize the fix before it reached any users.

On August 4th, 2026, Salvatore Gulizia, a security researcher, privately reported a severe vulnerability in Chrome’s JavaScript engine, V8, to Google. It earned the researcher a $1,000 bounty.

On August 7th, the fix was written and published to V8’s public open-source code repository.

Weeks later, at least 4 Chinese threat actors started exploiting the bug for cyberattacks before the fix reached any Chrome users.

Simply visiting malicious websites compromised users – attackers chained Windows and Chrome zero-day vulnerabilities to escape the sandbox and fully take over a system, researchers concluded.

The fix, after sitting exposed for nearly a month, was ultimately shipped to the public in the Chrome stable release on September 3rd – the rollout was staged over days, meaning that some users remained vulnerable for longer.

Researchers previously highlighted the “unusual patch gap.”

“The vulnerability was known and fixed upstream, making it an N-day at the Chromium source level, but there was no patch release for Google Chrome users. Therefore, the exploit was effectively a zero-day against Google Chrome,” Volexity said previously.

Just a few days later, on September 8th, Chrome switched to a 2-week release cycle, down from its previous 4-week cadence. The timing is coincidental – the change was first announced in March 2026.

This change narrows the window, but does not completely eliminate the problem – the so-called “N-day” gap, when the public code sits visible to attackers armed with AI but is not yet delivered to end users.

“With automated AI discovery tools and community bug reports generating higher patch volume, shorter release cycles make managing security fixes significantly simpler. Shrinking the window between landing a fix in the public codebase and delivering it to end users keeps the ‘N-day’ patch gap as small as possible,” Google said in a blog post.

Widespread adoption

The first attacks were detected on August 28th by 2 security firms, Proofpoint and Volexity. The China-aligned attackers chained 3 vulnerabilities: the aforementioned V8 bug, another V8 sandbox escape vulnerability, and a Windows zero-day privilege-escalation flaw, granting successful attackers SYSTEM privileges. Researchers dubbed this 3-bug exploit kit “BlueMoon.”

Within days, another highly targeted, espionage-motivated spearphishing campaign was detected. Then the number expanded to 4 hacking groups.

A fresh report from Volexity warns that additional threat actors have been discovered using the exploit kit on fake websites that mimic non-profits and attempt to deceive victims.

“Volexity discovered additional campaigns … that used the same chained exploits on September 3rd-4th, 2026, while the vulnerabilities were still unpatched,” the report reads.

“This seemingly widespread adoption across multiple threat actors suggests a coordinated effort within the Chinese computer network exploitation community.”

The researchers believe that the kit was shared, customized, and adopted by multiple groups, and the full scope is likely far broader than has been observed.

Hackers had a 4-week window and leveraged AI coding tools heavily to build exploits, as indicated by unusually verbose logs and code comments in the malware, which is atypical for espionage tools.

Fake sites mimic legitimate organizations

In recent attacks, hackers deployed convincing clones of trusted websites, often on typosquatted domains.

One spearphishing campaign targeted Asian government entities, urging readers to publicly support imprisoned Hong Kong activist Chow Hang-tung. The included links to fake domains spoofing the China Digital Times and the Center for American Progress.

Simply opening a website loaded the malicious components, leveraging the 3-bug kit. In this attack, the websites initiated malware downloads, disabled the “Mark of the Web,” the Windows security feature that warns about potentially unsafe files, and then launched the malware via the shell, making it invisible to users.

The malware itself was also previously undocumented. It schedules a task for persistence, and its main capabilities include file uploads and downloads, viewing running processes, shell access for additional commands, and running additional payloads.

Once active, it can run commands, list processes, upload or download files, and execute additional code supplied by its operators.

“Using real content from legitimate websites as decoy material continues to be an effective way to reduce user suspicion,” the researchers warned.

At least 4 more attackers were detected previously

The initial attacks were less refined.

The first attacks with the kit, identified by Proofpoint, targeted a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the US. The attackers posed as students from multiple universities who were interested in internships. The malicious websites installed browser extensions disguised as Google Gemini.

If the target clicked on the provided link to the actor-controlled domain hosting the exploits, they were shown a loading page for several seconds while the browser exploit was attempted, before being redirected to a legitimate website,

the Proofpoint report reads.

The second threat actor targeted US aerospace companies with fake Request for Quotation (RFQ) inquiries or other B2B lures, ultimately dropping a backdoor.

Yet another suspected espionage-motivated threat actor hit a Vietnamese manufacturing entity with messages sent from a compromised Southeast Asian government email address.

The fourth attacker targeted Singapore and Indonesia to deliver unknown custom malware.

Currently, all 3 vulnerabilities leveraged to deploy malware have been patched by Google and Microsoft:

• A type-confusion vulnerability in Chromium’s V8 JavaScript engine is tracked as CVE-2026-85046.
• A V8 sandbox escape is tracked as CVE-2026-87491. It allowed remote attackers to execute arbitrary code inside the sandbox.
• A Windows kernel Local Privilege Escalation (LPE) zero-day vulnerability was assigned the CVE-2026-85880 identifier.

Users are urged to promptly patch Chrome, Windows, and any other software and to avoid clicking suspicious links.