Chinese espionage groups swarm to exploit triple-link chain of zero-days

As cited

Copy frozen at 2026-09-10 00:44 UTC (site build).

threat intel

Chinese espionage groups swarm to exploit triple-link chain of zero-days

At least four Chinese state-aligned espionage groups exploited a chain of three zero-day vulnerabilities spanning Chromium-based browsers and Windows since late August 2026. The BlueMoon exploit kit targets CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to achieve remote code execution, sandbox escape, and privilege escalation. Groups including APT31 delivered the exploits via phishing emails to organizations in aerospace, mining, commodities trading, and government sectors across the United States and Southeast Asia.

Why it matters: Organizations running Chromium browsers and Windows face active exploitation by Chinese espionage groups; practitioners should prioritize patching CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 and monitor for malicious browser extensions, credential theft, and browser-based surveillance activity.

Source published

2026-09-09 21:17 UTC

First seen by Cybersecurity Tracker

2026-09-10 00:16 UTC