Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.
Proofpoint identified a new exploit kit dubbed BlueMoon chaining a Chromium V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel LPE (CVE-2026-85880). At least four distinct threat clusters, most with suspected China nexus, adopted the kit within days starting with TA412 (Violet Typhoon/APT31) on August 28, 2026. Both Chrome-side flaws were patch-gap zero-days with roughly a four-week exploitation window; the Windows LPE only works on Windows 10 and Server 2019/2022. TA412 used spearphishing posing as university interns to deliver the GemStone browser backdoor disguised as a Google Gemini extension; other clusters delivered ShadowPad via DLL sideloading and a Rust loader against targets in aerospace, government, and finance.
- BlueMoon chains V8 RCE, sandbox escape, and Windows kernel LPE
- TA412/APT31 first observed using the kit on August 28, 2026
- GemStone extension provides keylogging, cookie theft, and C2 via HTTP
- UNK_LateNight deployed ShadowPad via DLL sideloading at US aerospace firms
- Researchers suspect AI-assisted exploit development based on code artifacts
- ATT&CK
- T1566.001 Spearphishing AttachmentT1190 Exploit Public-Facing ApplicationT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege EscalationT1574.002 DLL Side-Loading
- Organizations
- Proofpoint
- Countries
- ChinaUnited StatesIndonesiaSingapore
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
From the original article
3 min read at cybersecuritynews.com
Multiple espionage-motivated threat actors have rapidly adopted a newly discovered exploit kit that chains Chrome browser and Microsoft Windows vulnerabilities to deploy backdoors and surveillance tools against government, defense, and commercial targets worldwide. Security researchers at Proofpoint have named the kit “BlueMoon,” identifying its use by at least four distinct threat clusters since late August […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.