Chinese Espionage Groups Weaponize Chromium Source Code Gap in Triple Zero-Day Attack

Proofpoint researchers identified a coordinated espionage campaign where at least four China-aligned groups utilized a trio of zero-day vulnerabilities starting in late August. The "BlueMoon" exploit chain targets Chromium-based browsers and Microsoft Windows, allowing attackers to escape the browser sandbox and gain system-level privileges.

The attacks chain two remote-code execution defects in the Chromium V8 JavaScript engine (CVE-2026-85046 and CVE-2026-87491) with a Windows Advanced Local Procedure Call privilege-escalation zero-day (CVE-2026-85880). APT31 initiated the campaign by sending phishing emails to US non-governmental organizations, mining companies, and commodity trading firms to install a malicious browser extension disguised as Google Gemini. Threat actors likely reverse-engineered the publicly available Chromium source code patches to weaponize the vulnerabilities in the gap before patched browsers were widely distributed. "All three vulnerabilities were exploited before patches were available to the public." — Mark Kelly