BlueMoon exploit kit chains Chrome and Windows zero-days in espionage campaigns

The BlueMoon exploit kit is a packaged browser exploit chain that turns one click on a phishing link into code execution outside Chrome's sandbox. Proofpoint named the kit and published its analysis on 9 September 2026, the same day Volexity documented parallel campaigns from its own telemetry.

The chain has three stages. CVE-2026-85046, a type confusion bug in Chrome's V8 JavaScript engine, gives an attacker arbitrary read and write access inside the V8 sandbox. CVE-2026-87491, a second V8 defect, corrupts WebAssembly module metadata to escape that sandbox. CVE-2026-85880, a heap-based buffer overflow in the Windows Advanced Local Procedure Call subsystem, then elevates the renderer process so the kit can inject into the parent Chrome process.

Per Proofpoint, the default final action is blunt. A curl command downloads an executable into %TEMP% and runs it. Operators change payloads by editing a single URL parameter.

A patch gap is the period when a security fix is visible in public open source code but has not yet reached the packaged product users run. Chromium is open source, Chrome is not shipped instantly, and that difference gave BlueMoon's developer a working head start.

Proofpoint reports that the change fixing CVE-2026-85046 was committed on 7 August 2026 but only reached the general stable Chromium build on 3 September 2026. That left close to four weeks in which the diff was public and no released patch existed. Volexity describes the same effect, noting the flaw was an N-day in Chromium source and a true zero-day for Chrome users.

Volexity assesses with medium confidence that the developer reverse engineered those upstream fixes. Proofpoint found no artifact that proves AI-assisted development, but flagged verbose debugging comments, heavy logging and a referenced markdown handover file as consistent with it.

Execution happens inside a dedicated Web Worker rather than the visible tab, so a failed attempt crashes a background thread instead of alerting the user. Volexity found a retry mechanism that stores an attempt counter in sessionStorage and relaunches the exploit up to five times.

Three binary components ride along, embedded as Base64 in the JavaScript. The first, p1, reflectively loads a DLL that profiles the host: Windows version and build, process token integrity level, CPU features and hypervisor indicators. The JavaScript reads that profile and decides whether to continue.

The second component, p2, runs the ALPC kernel exploit, but only when the process is not already elevated and the Windows build sits in a fixed target set. The third, pp, opens the Chrome browser process, writes a stub and calls CreateProcessA. From there the downloaded payload runs outside the renderer sandbox and looks like ordinary Chrome child activity.

Proofpoint identified four clusters, most with a suspected China nexus. TA412, also tracked as JungleBamboo, Violet Typhoon and APT31, was first, starting on 28 August 2026 against US NGOs, mining companies and physical commodity trading firms. Its payload was GemStone, a browser extension posing as an AI companion from Google Gemini that logs keystrokes and steals cookies.

UNK_LateNight followed on 2 September, targeting US aerospace companies with request-for-quotation lures and delivering the ShadowPad backdoor. UNK_DoubleCheck hit a Vietnamese manufacturer the same day using a compromised Southeast Asian government mailbox and a Rust loader chain. UNK_QuietRacket started on 3 September against government, consulting and financial organisations in Indonesia and Singapore.

Volexity separately tracked UTA0560, which phished NGO staff with donation lures and deployed the GRIMWEDGE JScript backdoor. The two vendors use different naming, so cluster counts do not map one to one.

All three flaws are patched, so the work is verification and hunting. Update Chrome to 153.0.8010.36/.37 or later, which carries both V8 fixes, and confirm the version actually deployed rather than the version offered. Other Chromium-based browsers pick up the same fixes on their own release schedules.

Apply Microsoft's September 2026 security updates for CVE-2026-85880. The privilege escalation stage only ran on builds 17763, 19041 to 19045, 20348 and 22000, which covers Windows 10 1809 through 22H2, Server 2019, Server 2022 and the initial Windows 11 release. Proofpoint notes most of those builds are unsupported, so an inventory pass is worth the time.

For hunting, Proofpoint highlights a distinctive process tree of chrome.exe launching cmd.exe, then curl.exe, then msgbox.exe. Also look for the sessionStorage key v8ctf_exp_attempt and unexpected scheduled tasks.

Proofpoint expects BlueMoon to spread further, including to financially motivated actors, as patched builds roll out across Chromium browsers. A kit that needs no exploit development skill to operate is attractive to anyone who can host a landing page.

The browser extension angle deserves attention too. Both vendors describe installers that forge Chromium's Secure Preferences integrity values to plant an extension without a Web Store prompt. Volexity notes that Chrome still permits a legacy hash fallback by default, and that disabling it means compiling Chromium from source. Organisations that do not manage extensions through policy have limited visibility into what is installed.

The broader pattern is the one worth tracking. Public upstream fixes plus fast reverse engineering equals a repeatable window, and that window is not specific to this kit or this quarter.