www.it-connect.fr
BlueMoon: How Updated PCs Were Compromised Through Chrome and Windows Flaws
Google Chrome is up to date. Windows is up to date. And yet, a single click on a malicious link is enough to install malware on your computer. This exploit has a name: BlueMoon, and it has been used by at least four cybercrime groups specializing in espionage. Here's what we know.
You may remember the CVE-2026-85046 zero-day flaw that Google patched on September 3, 2026 in Chrome 152, followed by CVE-2026-87491, fixed in Chrome 153 five days later. At the time, Google merely stated that an exploit was circulating in the wild, without sharing further details. We now know more thanks to two separate reports published by Proofpoint and Volexity.
These two vulnerabilities are a perfect example of what is known as the patch gap. In fact, they had already been fixed in the Chromium open source repository, which underpins several web browsers. Google Chrome, of course, but also Microsoft Edge, Brave, and Vivaldi. The problem is the delay between the patch being published in the source code and its arrival in the stable Chrome releases distributed to the general public. During that interval, attackers had time to read the patch, understand the vulnerability, and build an exploit. Meanwhile, users were unaware these vulnerabilities existed, and most importantly, they could not protect themselves.
For CVE-2026-85046, Proofpoint places the patch publication on August 7, 2026, and its integration into a stable Chrome release on September 3. "That opened a window of nearly four weeks during which the diff was publicly available without a patch being deployed", Proofpoint notes.
Three flaws chained together: from Chrome to Windows
The BlueMoon attack (the name given by Proofpoint) chains the exploitation of three vulnerabilities to move from a simple web page to malware execution on a Windows machine. Here are the three vulnerabilities involved:
- CVE-2026-85046. A type confusion in the JIT compiler of Chrome's V8 JavaScript engine. It allows malicious code to read from and write to engine memory.
- CVE-2026-87491. A second flaw in V8, related to WebAssembly, that allows escape from the V8 sandbox and loading of shellcode.
- CVE-2026-85880. A privilege escalation in the Windows kernel via the ALPC component. It is one of the two zero-days fixed by Microsoft during the September 2026 Patch Tuesday, as I wrote earlier this week. It is used to break out of Chrome's sandboxed renderer process.
This is interesting, because it lets us connect several zero-day flaws recently patched in Google Chrome and Windows.
In the context of these attacks, BlueMoon is presented as an exploitation kit where everything starts with an email containing a malicious link. If the user clicks the link, it triggers the installation of malware on their PC, and everything happens through the web browser before execution on Windows.
One important detail limits the scope of the attack, and I mentioned it in a previous article: CVE-2026-85880 does not affect all Microsoft operating systems. As Proofpoint notes, the exploit only targets older Windows builds, namely Windows 10 (from 1809 to 22H2), Windows Server 2019 and 2022, as well as the very first version of Windows 11 (21H2). Interestingly, a Windows 11 build is mentioned here: Microsoft did not mention it on its side.
At least four cyberespionage groups
Who benefits from the BlueMoon exploitation kit? The Proofpoint and Volexity reports provide some initial answers.
Proofpoint observed the first use of BlueMoon on August 28, 2026 by TA412, a China-linked group also known as APT31, JungleBamboo, or Violet Typhoon. Within days, three other espionage groups adopted it, using highly targeted phishing emails. Targets included NGOs, mining and commodities trading companies, aerospace firms, government agencies, and industrial organizations in the United States and Southeast Asia. Volexity, for its part, detected exploitation on September 1 by another Chinese actor, UTA0560, using the same exploit code.
The main difference lies in the malicious payload deployed at the end of the chain:
- TA412 installed a malicious Chromium extension disguised as a Google Gemini assistant, which Proofpoint calls GemStone and Volexity LONGTALE. It logs keystrokes, steals cookies and browser storage, takes screenshots, and receives commands from its operators.
- UNK_LateNight deployed the ShadowPad backdoor against U.S. aerospace companies, using domains impersonating their names.
- UNK_DoubleCheck and UNK_QuietRacket delivered custom infection chains, including a Rust loader and another loader that resolves the address of its command-and-control servers via DNS-over-HTTPS requests through Google.
It is still worth asking how the same exploitation kit ended up in the hands of several groups so quickly. One might think it was sold at some point.
A kit developed with the help of AI?
The exploitation kit contains unusual artifacts: verbose logging, comments detailing debugging iterations, a reference to a Markdown document, and to v8CTF, Google's bug bounty program for V8. "These development artifacts are broadly consistent with AI-assisted development, even though no single artifact proves it on its own", Proofpoint writes. Proofpoint goes even further in its reasoning, wondering whether the CTF pretext may have been used to bypass AI safeguards.
This case is a reminder of the importance of installing security updates for software and operating systems, even if in this instance there was a period of time when "everyone" was vulnerable. I will also take this opportunity to highlight my tutorial on hardening Chrome, Edge, and Firefox through GPOs.
