China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks

Researcher has discovered a rapidly spreading exploit kit called BlueMoon, which combines vulnerabilities in the Chrome browser with a Windows kernel privilege-escalation flaw to compromise targets in espionage campaigns.

This activity was first observed on August 28, 2026, and at least four threat clusters have adopted it, most of which are suspected to have ties to China.

The initial user of BlueMoon was TA412, also known as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE.

This group has previously been linked to Chinese state-sponsored espionage operations and has targeted U.S. non-governmental organizations, mining firms, and physical commodity trading companies.

Within days of its initial observation, other clusters, including UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, began deploying the same exploit chain against targets in the aerospace, manufacturing, government, consulting, and financial sectors.

Chrome-to-Windows Exploit Chain

BlueMoon combines three vulnerabilities and execution stages to transition from a phishing link to code execution outside of Chrome’s renderer sandbox:

• CVE-2026-85046, a V8 JavaScript engine type-confusion bug enabling remote code execution in Chromium-based browsers.
• A V8 sandbox escape that allows attacker-controlled shellcode to execute beyond the browser renderer.
• CVE-2026-85880, a Windows kernel local privilege escalation flaw used against older Windows builds.

The Chrome vulnerability is particularly concerning as a “patch-gap” zero-day. Although the relevant fix for the V8 vulnerability was committed to the public Chromium source code on August 7, it wasn’t incorporated into the stable Chromium build until September 3.

This created a nearly four-week window during which attackers could reverse-engineer the public patch and weaponize the flaw against users of stable Chrome and other Chromium-based browsers.

The V8 exploit exploits an optimization weakness involving `Array.prototype.sort()` and `Array.fill()`. By changing the element type of an array during a sort operation, BlueMoon tricks V8’s Maglev and TurboFan optimizing compilers into treating object references as small integers.

This creates an address leak that lets the exploit construct `addrof` and `fakeobj` primitives, ultimately achieving arbitrary read/write access within V8’s heap cage.

Next, BlueMoon corrupts WebAssembly module metadata to overwrite compiled function bodies with shellcode. A reconnaissance DLL loaded reflectively identifies the Windows version, build number, Chrome integrity level, and `kernelbase.dll` version before determining whether the target is suitable for local privilege escalation.

The local privilege escalation (LPE) component of BlueMoon targets specific older Windows versions: Windows 10 version 1809; Windows 10 versions 2004 through 22H2; Windows Server 2019 and 2022; and Windows 11 for version 21H2.

The exploit uses Advanced Local Procedure Call and Windows Notification Facility mechanisms to gain kernel read/write access and enable the `SeDebugPrivilege` in the Chrome renderer process.

With elevated privileges, BlueMoon injects shellcode into the parent Chrome broker process. The default launcher utilizes `curl` to download an executable, save it as `%TEMP%\msgbox.exe`, and execute it outside the browser sandbox. This behavior provides defenders with potentially high-confidence indications for endpoint detection.

TA412 employed BlueMoon to install GemStone, a malicious Chrome extension that masquerades as an AI-powered Google Gemini browsing companion.

This extension collects keystrokes, cookies, browser storage, navigation activity, active tab metadata, and screenshots. It also modifies Chromium Secure Preferences files with valid HMAC values, allowing the extension to install without triggering typical integrity protections.

UNK_LateNight targeted U.S. aerospace organizations with business-to-business and request-for-quotation lures. Its deployment of BlueMoon delivered ShadowPad through a DLL sideloading chain, created a scheduled task for persistence called EdgeCore_AutoUpdate, and communicated with command-and-control infrastructure over HTTPS.

Meanwhile, UNK_DoubleCheck used compromised Southeast Asian government email accounts to target a Vietnamese manufacturer and delivered a Rust-based in-memory loader.

UNK_QuietRacket focused on Singapore and Indonesia, using conference-themed phishing emails, and deployed a DLL sideloading chain that used DNS-over-HTTPS TXT records for command-and-control resolution.

Proofpoint noted that BlueMoon’s extensive debug logging, implementation comments, and references to a markdown handover document may suggest the kit was developed with AI assistance.

While this assessment remains unconfirmed, the exploit’s rapid adoption highlights how publicly visible Chromium patches can greatly reduce the time and expertise needed to operationalize browser exploitation.

Ioc

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.