Chinese Actors Chain Chrome and Windows Zero-Days

In September 2026, Volexity identified two distinct Chinese threat actors, UTA0560 and JungleBamboo (APT31), leveraging a shared multi-stage exploit chain to target NGOs and other sectors. The campaign, dubbed 'BlueMoon', exploited a patch-gap where vulnerabilities were fixed in the open-source Chromium codebase but had not yet reached a stable Google Chrome release, effectively serving as zero-days for the attackers.

The exploit chain involves three vulnerabilities: CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (Chrome WebAssembly sandbox escape), and CVE-2026-85880 (Windows Kernel LPE). While the initial exploitation method—spear-phishing and reflected XSS—was identical, the threat actors deployed different post-exploitation payloads tailored to their specific objectives.

This activity highlights the critical risk of patch disclosure windows. Threat actors are increasingly capable of reverse-engineering upstream fixes in open-source components before downstream products are updated. The urgency for organizations to monitor browser integrity and maintain rapid patching cycles for both browsers and operating systems remains paramount.