The Patch-Gap Zero-Day Chain — Chromium-Fixed, Chrome-Unfixed Bugs Shared by Multiple Spy Groups in a Week
Volexity observed the BlueMoon chain — Chrome V8 sandbox read/write, sandbox escape, and Windows ALPC abuse — shared by multiple China-nexus clusters. The upstream Chromium fixes had not yet shipped in stable Chrome, creating a dangerous "patch gap". We unpack the implications.
On September 15, 2026, Volexity reported that a threat cluster described as originating in China (UTA0560) used an attack chain (which it calls BlueMoon) that chains vulnerabilities in Google Chrome and Microsoft Windows, in a targeted email attack on September 1 against multiple NGOs. A link in the email exploited reflected XSS on a university site in the United States to lead the target to attacker-controlled infrastructure, where a 3-stage exploit was deployed. CVE-2026-85046 obtains arbitrary read/write inside the V8 sandbox, CVE-2026-87491 escapes the browser sandbox, and finally CVE-2026-85880 abuses Windows Advanced Local Procedure Call (ALPC) to inject code into the Chrome process and reach arbitrary code execution. Volexity also notes that the attacker applied an exclusion filter for anything other than Chrome on Windows (according to reporting by Volexity / The Hacker News).
Analysis (separated from facts): what stands out is the "sharing" of the same exploit chain. In Volexity's observation, around the time UTA0560 deployed a JavaScript backdoor called GRIMWEDGE (an initial foothold of moderate capability that receives commands from C2 by eval), JungleBamboo (APT31) also deployed a loader, SUPERSTOMP, on the same chain, and in the end installed LONGTALE, an information-stealing Chrome extension that impersonated a legitimate Google Gemini extension. Media headlines reported that "4 spy groups used the same kit in 1 week" (The Hacker News), and the possibility is suggested that a developer reconstructed the exploit from the Chromium source diff and provided it to multiple clusters. A structure in which exploits circulate like a "product" means that generalization of the attack surface is fast.
The technically most interesting point is the patch gap. Fixes for the 2 Chrome vulnerabilities (CVE-2026-85046 / CVE-2026-87491) had been committed ahead of time in Chromium's open-source code, but were not yet included in a stable Chrome release. Software whose commit history is public always carries the risk that attack code is reconstructed from the fix diff, but this case is a real example in which a state that differs from both an ordinary N-day and a zero-day — "fixed upstream, unfixed downstream" — was used in a real attack. That Chrome's major-release cycle was 4 weeks until recently (it is 2 weeks now) can also be considered one reason the attacker could more easily aim at the window, but this cannot be asserted. Volexity points out that the more LLMs speed up vulnerability research and exploit development, the more the danger of the patch gap increases.
Defensive implications: (1) The first point of contact in the targeted attack was "reflected XSS on a legitimate site." Before perimeter defense, it becomes important not to let XSS on your own site become a stepping stone in the chain. (2) Against a chain that crosses both the browser and the OS, both browser isolation (site isolation and a forced sandbox) and endpoint detection have meaning. (3) A patch gap cannot be prevented by "speed of applying patches." It is a region where a team that tracks upstream commits, and vendor-side care that considers the disclosure risk of a fix before release, first take effect. (4) Against extension impersonation such as LONGTALE, an inventory of installed extensions is a practical countermeasure. The facts in this article are based on Volexity's report and reporting by The Hacker News and BleepingComputer, and the analysis portion is written separately from the facts.