China-Aligned Espionage Groups Exploit Three Zero-Day Vulnerabilities in Chromium and Windows

At least four China-aligned espionage groups have been observed exploiting a chain of three zero-day vulnerabilities in Chromium's V8 JavaScript engine (CVE-2026-85046, CVE-2026-87491) and a Windows ALPC privilege-escalation flaw (CVE-2026-85880) in a campaign dubbed "BlueMoon." Google has released Chrome updates patching 230 security issues, including one under active exploitation.