Four state-aligned espionage crews picked up the same zero-day exploit kit within roughly twelve days of each other, Proofpoint reported, naming the kit BlueMoon. It chains two Google Chrome flaws with a Windows kernel bug to take over a browser that reports itself up to date, then the machine behind it. Volexity, a threat-intelligence and incident-response firm, tracked a separate operator running the same kit days later.
Inside the BlueMoon zero-day exploit kit
BlueMoon is a shared, modular tool, and the two reports describe separate crews plugging into it rather than building their own capability. Proofpoint first saw it on August 28, 2026 in spearphishing from TA412, the China-aligned group also tracked as JungleBamboo, Violet Typhoon, APT31 and TIDE CASTLE, which went after United States non-governmental organizations (NGOs), mining companies and commodity traders. Volexity logged a separate operator, UTA0560, on September 1 running donation lures against NGO donors. Two more China-aligned clusters followed within days: UNK_LateNight hit US aerospace and defense firms with the ShadowPad backdoor, and UNK_QuietRacket struck government and financial targets in Indonesia and Singapore.
The kit chains three flaws. CVE-2026-85046 is a type-confusion bug in the V8 JavaScript engine that Chrome and other Chromium browsers share, giving code execution in the renderer. CVE-2026-87491 escapes the V8 sandbox by corrupting WebAssembly data to run shellcode. CVE-2026-85880 is a Windows kernel local privilege escalation (LPE) zero-day that carries the payload from the browser to the whole machine.
Why the Chrome patch gap made this work
Both Chrome bugs were public knowledge when BlueMoon used them. Each was already fixed in the open Chromium source, but the fix had not yet shipped in the stable Chrome build most people run. The change for CVE-2026-85046 landed in public source on August 7 and did not reach a stable release until September 3, leaving nearly four weeks in which anyone could read the code and rebuild a working exploit from it. Fix velocity in the open-source tree runs ahead of the release train that puts patches on real machines, and BlueMoon lived in that gap. The exposure was not a hidden flaw nobody could have known about but a published, already-fixed bug that had not yet reached endpoints, and a shared kit let four crews mine it at once. Attackers raced through the same kind of window in other recent zero-day campaigns. The Windows flaw is different in kind: CVE-2026-85880 is a genuine privilege escalation zero-day with a 2025 compile date, repackaged into the kit to turn browser access into full control.
Both reports ship indicators of compromise, and Proofpoint notes the kit leaves a loud process tree: chrome.exe spawning cmd.exe, then curl.exe pulling a loader into %TEMP%. Security teams reviewing their exposure should check how quickly the stable Chrome channel installs once a Chromium fix is public, whether that schedule is centrally managed, and whether CVE-2026-85880 is patched on older Windows builds.
Join our LinkedIn group Information Security Community!
