China-Linked Hackers Exploit Chrome and Windows Zero

Gbhackers •Divya • September 10, 2026

Researcher has discovered a rapidly spreading exploit kit called BlueMoon, which combines vulnerabilities in the Chrome browser with a Windows kernel privilege-escalation flaw to compromise targets in espionage campaigns. This activity was first observed on August 28, 2026, and at least four threat clusters have adopted it, most of which are suspected to have ties […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by other groups within days. The exploit kit chains three vulnerabilities: CVE-2026-85046, a type confusion flaw in Chrome's V8 JavaScript engine, a V8 sandbox escape, and CVE-2026-85880, a Windows local privilege escalation vulnerability. The exploit takes advantage of a four-week patch gap, allowing attackers to reverse-engineer fixes before they are applied to stable releases. The targeted sectors include U.S. defense contractors, NGOs, and Southeast Asian government agencies. Microsoft and Google have since released patches for the vulnerabilities. The situation remains dynamic, with ongoing investigations into the extent of the exploitation and the actors involved. 18 sources 81

Extracted Entities

China-Linked Hackers Exploit Chrome and Windows Zero

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)