This post is also available in:
עברית (Hebrew)
Software companies regularly publish security fixes, but a patch becoming public does not necessarily mean users are protected immediately. The time between revealing a code change and distributing the corresponding software update can give attackers an unusual advantage: they can study the fix to work out exactly what vulnerability it repairs.
Security researchers say at least four China-aligned hacking groups exploited that gap in a recent campaign involving Google Chrome and Windows.
The chain began with a vulnerability in Chrome’s V8 JavaScript engine, privately reported to Google on August 4th, 2026. Google developed a fix and published the change to V8’s open-source repository on August 7th.
However, the updated Chrome version had not yet reached users. That left the code change publicly visible for weeks, potentially allowing attackers to compare the patched and vulnerable versions and reverse-engineer the underlying security flaw.
By August 28th, researchers at Proofpoint and Volexity had detected attacks using the vulnerability. The hackers combined it with a second V8 flaw and a Windows privilege-escalation zero-day, creating a three-stage exploit chain researchers named BlueMoon.
Together, the vulnerabilities could move an attack from a malicious webpage through Chrome’s security boundaries and ultimately provide SYSTEM-level privileges in Windows.
According to Cyber News, later campaigns used convincing copies of legitimate websites hosted on lookalike domains. Victims were directed to the pages through targeted spearphishing messages. Simply visiting the malicious site could trigger the exploit chain and begin installing malware.
Researchers found that the malware could establish persistence through a scheduled task, execute commands, inspect running processes, transfer files and download additional payloads. Some attacks also disabled Windows’ Mark of the Web, which normally helps warn users about potentially unsafe downloaded files.
Researchers believe the exploit kit was shared and modified among multiple China-aligned threat actors. They also found unusually detailed comments and logs suggesting that AI coding tools may have been used extensively during development, although this does not establish precisely how much of the exploit was AI-generated.
The campaigns targeted organizations including government entities, NGOs, aerospace companies, manufacturers and commodity-related businesses, giving the vulnerability clear relevance to national security and industrial espionage.
All three exploited vulnerabilities have since been patched by Google and Microsoft.
The incident highlights a difficult problem for open-source security. Publishing code enables independent review and collaborative development, but a security fix can also function as a clue for attackers if users remain exposed to the vulnerable version.
Google has shortened Chrome’s release cycle to two weeks, reducing that window, but the underlying race remains. Once a fix becomes visible, defenders are no longer the only people studying it, and getting the update onto users’ machines quickly can be just as important as writing the patch itself.
