A Perfect Copy of a Trusted Website Delivered Three Chained Zero-Days
The pages borrowed real content from trusted organisations while a hidden frame delivered the already shared exploit chain.
CVE-2026-85046
Google Fixed 230 Chrome Bugs. One Was Already in Attackers’ Hands.
Google's exploited V8 flaw was one stage in BlueMoon, a three-vulnerability Chrome and Windows chain that multiple espionage groups adopted within days. Patch both Chrome and Windows, then hunt the published indicators.
Chrome’s 327 Security Fixes Were Only the Warm-Up
Google patched CVE-2026-85046 in Chrome 152.0.7977.82/.83 after confirming an exploit in the wild. CISA set a federal deadline of 18 September.