Vulnerabilities · 46 days ago
Proofpoint says multiple espionage groups have picked up the BlueMoon exploit kit within days of Violet Typhoon’s first use on August 28. The kit chains two Google Chrome V8 zero-days, CVE-2026-85046 and CVE-2026-87491, with a Windows privilege-escalation flaw, CVE-2026-85880, so one malicious page can move from browser code execution to higher control of the host.
The chain starts inside Chrome’s sandbox, then uses the Windows bug to escape the browser boundary and reach system level. Proofpoint says that makes the kit easy to reuse: patching Chrome alone does not close the route if the Windows flaw is still open, and the same exploit chain can be repackaged by different operators.
For Windows fleets that rely on Chrome as a controlled entry point, the exposure now sits in the trust chain itself, not just in one browser campaign. Proofpoint’s finding also leaves open how widely the kit has already spread, which matters because a tool this easy to adopt can outgrow the group that first used it.
Known exploited · CISA KEV
CVSS 8.8 HIGH: type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Microsoft patch: Release Notes.
CISA federal remediation date Sep 18
Known exploited · CISA KEV
CVSS 7.8 HIGH: heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. Microsoft patch: 5122876.
Patch available KB5122876 Download →
CISA federal remediation date Sep 22
Known exploited · CISA KEV
Microsoft patch: Release Notes.
CISA federal remediation date Sep 23
3 sources covering this story
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Multiple espionage-motivated threat actors have adopted BlueMoon in opportunistic, rushed deployments.
Attackers are weaponizing the gap between Chromium fixes and Chrome patches
The ‘BlueMoon’ attack chains three high-severity Chrome and Windows flaws, raising concerns that sophisticated exploitation is becoming faster and more reusable.
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple cyber-espionage groups deployed an exploit kit dubbed
Part of the PlainSec briefing for 2026-09-10