Spyware Vendors, China Hackers Led 2025 Zero-Days

🔑 Enhanced Key Takeaways

• •Commercial surveillance vendors were attributed to 15 of 42 tracked zero-days, surpassing state-sponsored groups (12) for the first time[1][2].
• •China-nexus espionage groups exploited at least 10 zero-days, doubling from 2024, with UNC3886 targeting Juniper MX routers via CVE-2025-21590[2].
• •Operating systems saw 39 zero-day exploits (most common category), mobile OS 15, while browsers dropped below 10% due to improved hardening[3].
• •Google patched 8 zero-days in Chrome, including V8 type confusion flaws CVE-2025-10585 and CVE-2025-13223 linked to spyware vendors[5].

🛠️ Technical Deep Dive

• •CVE-2025-10585: Type confusion in Chrome V8 JavaScript engine's JIT optimization pipeline, enabling heap corruption via crafted HTML; patched in 24 hours after GTIG discovery[5].
• •CVE-2025-13223: V8 vulnerability exploited in espionage by spyware vendors selling chains to governments; seventh Chrome zero-day of 2025[5].
• •Operation ForumTroll chain: Undisclosed renderer exploit + CVE-2025-2783 sandbox escape deploying Trinper backdoor; prompted Firefox CVE-2025-2857 patch[5].
• •SonicWall attacks: Chained authentication bypass, RCE, and privilege escalation vulnerabilities targeting enterprise appliances[3].
• •CVE-2025-21590: Improper isolation in Juniper MX routers exploited by UNC3886 for network access[2].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline