Zero-day chain of «patch gap» — bugs wey dem don fix for Chromium but wey dem never fix for Chrome, wey multiple spy groups share inside 1 week
E come out say di BlueMoon attack chain, wey join Chrome V8 sandbox escape with Windows ALPC abuse, dey shared by at least multiple clusters wey dem describe as China-origin, according to Volexity observation. Fix don enter Chromium but e never reflect for stable Chrome, and we dey arrange di danger of dis «patch gap».
Dis article na machine translation.
For 15 September 2026, Volexity report say threat cluster UTA0560, wey dem describe as China-origin, use targeted email attack for 1 September against multiple NGOs, attack chain (wey dem call BlueMoon) wey chain Google Chrome and Microsoft Windows vulnerabilities. Di link inside di email exploit reflected XSS on United States university site to redirect to infrastructure wey di attacker control, and there exploit of 3 stages dey deploy. With CVE-2026-85046 dem gain arbitrary read and write inside di V8 sandbox, with CVE-2026-87491 dem escape di browser sandbox, and last with CVE-2026-85880 dem abuse Windows Advanced Local Procedure Call (ALPC) to inject code into di Chrome process and reach arbitrary code execution. Volexity also point say di attackers dey filter out anything wey no be Chrome on Windows (according to Volexity / The Hacker News reporting).
Analysis (wey we separate from facts): wetin deserve note na di «sharing» of di same exploit chain. For Volexity observation, around di time UTA0560 deploy JavaScript-type backdoor wey dem call GRIMWEDGE (initial foothold of moderate capability wey dey receive commands by eval from C2), JungleBamboo (APT31) too deploy loader SUPERSTOMP with di same chain, and finally install info-stealing Chrome extension LONGTALE wey disguise as legitimate Google Gemini extension. Media headlines report say «4 spy groups use di same kit inside 1 week» (The Hacker News), and dat suggest di possibility say developers rebuild di exploit from Chromium source diffs and give am to multiple clusters. Structure where exploits dey circulate like «product» mean say generalization of di attack surface dey fast.
Technically, wetin dey most interesting na di patch gap. Fixes for 2 Chrome vulnerabilities (CVE-2026-85046 / CVE-2026-87491) don commit earlier for Chromium open-source code, but dem never enter stable Chrome release. For software wey commit history dey public, di risk to rebuild attack code from fix diffs always dey follow, but dis case na example where state «fixed upstream, not yet fixed downstream» — different from ordinary N-day and from zero-day — dey used for real attack. Di fact say Chrome major release cycle na 4 weeks until recently (now e na 2 weeks) fit be one reason wey make am easier for attackers to aim di window, but dis no fit assert for sure. Volexity point say as LLMs dey speed vulnerability research and exploit development, di danger level of di patch gap dey increase.
Implications for di defensive side: (1) Di first contact of di targeted attack na «reflected XSS on legitimate site». Before boundary defense, e matter make your own site XSS no become stepping stone for di chain. (2) Against chain wey cross both browser and OS, browser isolation (site isolation, enforced sandbox) and endpoint detection both get meaning. (3) Patch gap no fit prevent by «speed of applying patches». Dis na area where teams wey track upstream commits, and vendor care about di disclosure risk of fix before release, first dey work. (4) Against extension disguise like LONGTALE, inventory of installed extensions na practical measure. Di facts of dis article base on Volexity report, The Hacker News, and BleepingComputer, and di analysis part dey written separate from di facts.