New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Source Bleeping Computer
Mentioned vulnerabilities
Rated Critical by Threat Radar from the Bleeping Computer text
Data as of 09/10/2026, 14:22:24 UTC
What to do
AI-suggested
Since BlueMoon exploits zero-day vulnerabilities, no official fixes may have been available at the time of observed activity. Defenders should monitor vendor advisories closely for patches addressing CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Use provided indicators of compromise from Proofpoint and Volexity reports to detect and block BlueMoon activity early. Organizations targeted by these campaigns should prioritize applying updates once available and consider enhanced phishing defenses given the spearphishing delivery vector.
Description
The BlueMoon exploit kit is a modular tool used by multiple cyber-espionage groups to chain zero-day vulnerabilities in Microsoft Windows and Google Chrome. It combines two Chromium-based browser flaws allowing remote code execution and sandbox escape with a Windows kernel local privilege escalation. Observed since August 2026, BlueMoon has been deployed by Chinese state-sponsored actors targeting NGOs, aerospace, defense, and manufacturing sectors. The kit exploits delays in Chrome stable releases to weaponize recent Chromium fixes. It executes payloads by elevating Chrome renderer privileges and injecting commands to download and run malware loaders.
Impact
Successful exploitation allows attackers to execute arbitrary code remotely in the Chrome browser, escape the browser sandbox, and escalate privileges on the Windows host to SYSTEM level. This chain enables attackers to inject commands into the Chrome parent process to download and run malware loaders, facilitating persistent and stealthy access. Targets include high-value organizations such as NGOs, aerospace, defense, and manufacturing sectors. The exploit kit supports modular additions, increasing its potential threat scope. The Windows local privilege escalation exploit appears to have been used since 2025 and repackaged into BlueMoon, indicating a mature capability.
Summary
BlueMoon is an exploit kit leveraging three zero-day vulnerabilities: CVE-2026-85046, a type-confusion flaw in Chrome's V8 engine enabling arbitrary memory access; CVE-2026-87491, a sandbox escape via corrupted WebAssembly metadata; and CVE-2026-85880, a Windows ALPC heap-based buffer overflow allowing local privilege escalation. The kit runs exploits inside a Web Worker, retries up to five times, fingerprints the system, elevates Chrome renderer privileges via the Windows LPE, and injects commands to download and execute malware. It has been used since at least August 2026 by multiple threat actors including JungleBamboo (APT31) and UTA0560, targeting NGOs, US aerospace and defense companies, and Vietnamese manufacturers. BlueMoon exploits the gap between Chromium patch releases and stable Chrome updates by reverse-engineering public fixes to create exploits targeting downstream users.