Four threat groups exploit same Chrome and Windows zero-day vulnerabilities

In early September 2026, researchers uncovered a rare and unsettling convergence: four separate state-aligned threat groups simultaneously weaponizing the same two-stage exploit chain targeting Chrome's V8 engine and the Windows operating system. The attack defeats one of the browser's most trusted defenses — the sandbox — and delivers attackers direct access to the underlying system. That four distinct actors arrived at the same toolkit so quickly forces a deeper question about how dangerous knowledge travels in the modern world, whether through intelligence alliances, underground markets, or