BlueMoon Exploit Kit Weaponizes Chromium Patch-Gap and Windows Zero-Day

Espionage-motivated threat actors are actively deploying a newly discovered malicious toolkit dubbed the BlueMoon exploit kit, chaining together two Chromium V8 engine flaws—including CVE-2026-85046—and an unpatched Windows kernel zero-day. By weaponizing the temporal window between open-source Chromium codebase fixes and binary deployment in stable browser releases, attackers have created a modular capability that enables full endpoint takeover with a single click. Joint research published by Proofpoint, Google’s Threat Intelligence Group, Microsoft’s Threat Intelligence Center (MSTIC), and Volexity reveals that multiple threat clusters rapidly integrated this attack chain into targeted spear-phishing campaigns within days of its development.

The BlueMoon Attack Chain

The BlueMoon exploit kit relies on a three-tier execution chain designed to escape browser isolation and escalate host privileges:

1. Initial Code Execution via Type Confusion (CVE-2026-85046): The attack begins when a target visits a compromised or attacker-controlled web page. BlueMoon exploits a type confusion vulnerability classified under CWE-843 in Chromium’s open-source V8 JavaScript engine. Type confusion occurs when the JavaScript engine allocates memory for one data structure type but subsequently accesses it as a different, incompatible type. This mismatch allows an attacker to corrupt internal memory structures and execute arbitrary code within the browser renderer process.
2. V8 Sandbox Escape (CVE-2026-87491): Once execution is achieved within the renderer, the kit triggers a WebAssembly defect that bypasses V8’s internal sandbox boundaries. While the V8 sandbox is designed to prevent memory corruption from escaping to the broader desktop process, this defect breaks out of those guardrails.
3. Local Privilege Escalation (CVE-2026-85880): To achieve complete system compromise, BlueMoon executes a high-severity Windows kernel Local Privilege Escalation (LPE) zero-day flaw. This payload targets older, widespread Windows OS builds—specifically Windows 10 version 22H2 and Windows 11 version 21H2—elevating privileges from the standard user context directly to admin or NT AUTHORITY\SYSTEM.

Combining these three high-severity vulnerabilities transforms a simple link click into a complete, silent takeover of the target endpoint.

Exploiting the Upstream Patch Gap

The core driver behind BlueMoon’s rapid success is the structural delay between open-source software maintenance and downstream client patching. CVE-2026-85046 was initially reported to the Chromium project on August 4, 2026. A patch was promptly committed to the public Chromium repository (commit e0562d87ad9c17042b581582c99237d798572e67).

However, because public commit histories are visible to everyone, adversary groups used automated tooling and AI agents to reverse-engineer the source diff. They constructed a functional exploit before Google Chrome and other Chromium-based browsers (such as Microsoft Edge, Brave, and Vivaldi) pushed updated binaries to end users in Google Chrome build 152.0.7977.82 and V8 release 15.3.48.

[ August 4: Bug Reported ] ---> [ Upstream Code Commit ] ---> [ Reverse Engineering Window ] ---> [ Downstream Patch Released ]
                                                                       |
                                                                (BlueMoon Weaponized)

This delay creates an “N-day in public source, zero-day in production software” dynamic. From a vulnerability metrics perspective, CVE-2026-85046 carries a CVSS v3.1 score evaluated with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Its Exploit Prediction Scoring System (EPSS) probability sits at 1.3% (67.9th percentile). While a 1.3% EPSS score might appear modest compared to mass-scanned server vulnerabilities, EPSS models broadly measure opportunistic internet-wide activity. For targeted spear-phishing kits like BlueMoon—where social engineering guarantees user interaction—that probability understates the immediate, severe risk to enterprise endpoints.

Targeted Campaigns and Threat Actor Tradecraft

First observed in active operations on August 28, BlueMoon was initially wielded by a China-aligned, state-sponsored threat group. The campaign selectively targeted a narrow set of US-based non-governmental organizations (NGOs), mining corporations, and physical commodity trading firms.

The actors relied on sophisticated social engineering to lure victims to BlueMoon landing pages, including:

• Personas posing as university students inquiring about corporate internships.
• Outreach communications regarding industry conferences.
• Multi-stage, rapport-building conversational exchanges over email and social platforms.

When a user clicked the lure link, they were routed to an actor-controlled domain displaying a generic loading screen for several seconds while BlueMoon executed its exploit chain in the background. Once the privilege escalation zero-day established host access, the site immediately redirected the victim to legitimate platforms like GitHub to obscure the attack.

Within days of the initial campaign, three additional espionage-motivated clusters—the majority possessing suspected China-nexus ties—began utilizing the identical BlueMoon kit. The rapid adoption across disparate threat groups indicates that BlueMoon is operating as reusable, modular attack infrastructure shared across state-aligned operational clusters rather than a single group’s bespoke exploit.

Urgent Remediation and Hunting Guidance

Because BlueMoon operates across both browser software and operating system layers, remediation requires immediate multi-tier patching and post-exploitation artifact hunting:

• Browser Patching: Immediately update Google Chrome to version 152.0.7977.82 or higher across all enterprise endpoints. Ensure all secondary Chromium-based browsers are updated past V8 engine build 15.3.48.
• OS Patching: Apply the latest Microsoft Windows security updates to patch CVE-2026-85880, giving immediate priority to systems running Windows 10 22H2 and Windows 11 21H2.
• Endpoint Artifact Hunting: Deploying software patches will close the vulnerability window but will not remove persistent access mechanisms installed prior to patching. Security teams must actively hunt endpoint telemetry for post-exploitation artifacts created during or after the August 28 campaign window, including:
  • Newly added or unrecognized Google Chrome extensions.
  • System-level scheduled tasks created under user contexts.
  • Unexpected modification of Windows registry keys associated with startup programs or administrative utility persistence.
• Network & SIEM Detections: Configure EDR and network logging tools to flag HTTP connections that hold open multi-second idle loading sessions prior to sudden HTTP redirects to legitimate domains like github.com.