Attackers are weaponizing the gap between Chromium fixes and Chrome patches
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
82
Victim
US NGOs
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 9, 2026
- Last mentionedSep 11, 2026
Timeline
3 articles · newest firstHackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.
86
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
85
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
Appears with
- Chromeproduct · 3
- ShadowPadmalware · 2
- TA412threat actor · 2
- UNK_DoubleCheckthreat actor · 2
- Proofpointvendor · 2
- Chromiumproduct · 2
- UNK_QuietRacketthreat actor · 2
- UNK_LateNightthreat actor · 2
- Googlevendor · 2
- Southeast Asian government agenciesvictim · 1
- Windowsproduct · 1
- Chromiumvendor · 1
- mining companiesvictim · 1
- Proofpointorganization · 1
- Windows Server 2019product · 1
- Volexityvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.