BlueMoon is an exploit kit leveraging three zero-day vulnerabilities: CVE-2026-85046, a type-confusion flaw in Chrome's V8 engine enabling arbitrary memory access; CVE-2026-87491, a sandbox escape via corrupted WebAssembly metadata; and CVE-2026-85880, a Windows ALPC heap-based buffer overflow allowing local privilege escalation. The kit runs exploits inside a Web Worker, retries up to five times, fingerprints the system, elevates Chrome renderer privileges via the Windows LPE, and injects commands to download and execute malware. It has been used since at least August 2026 by multiple threat actors including JungleBamboo (APT31) and UTA0560, targeting NGOs, US aerospace and defense companies, and Vietnamese manufacturers. BlueMoon exploits the gap between Chromium patch releases and stable Chrome updates by reverse-engineering public fixes to create exploits targeting downstream users.

Successful exploitation allows attackers to execute arbitrary code remotely in the Chrome browser, escape the browser sandbox, and escalate privileges on the Windows host to SYSTEM level. This chain enables attackers to inject commands into the Chrome parent process to download and run malware loaders, facilitating persistent and stealthy access. Targets include high-value organizations such as NGOs, aerospace, defense, and manufacturing sectors. The exploit kit supports modular additions, increasing its potential threat scope. The Windows local privilege escalation exploit appears to have been used since 2025 and repackaged into BlueMoon, indicating a mature capability.

Patch status is not yet confirmed — check the vendor advisories from Microsoft and Google for current remediation guidance. Since BlueMoon exploits zero-day vulnerabilities, no official fixes may have been available at the time of observed activity. Defenders should monitor vendor advisories closely for patches addressing CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Use provided indicators of compromise from Proofpoint and Volexity reports to detect and block BlueMoon activity early. Organizations targeted by these campaigns should prioritize applying updates once available and consider enhanced phishing defenses given the spearphishing delivery vector.