BlueMoon: The Shared Exploit Kit Accelerating the Race for Chrome Vulnerabilities

At least four distinct cyber-espionage groups, most linked to Chinese intelligence, have used the same exploit kit—dubbed BlueMoon—since August 28, 2026, to target the same Chrome zero-day vulnerability. The finding, published today by Proofpoint, documents for the first time the sharing of a browser exploit chain among distinct threat actors within a window of just days, with repercussions for Chromium vulnerability response.

The BlueMoon Chain: From V8 to the Windows Kernel

BlueMoon chains three components to achieve full system compromise. The first step exploits CVE-2026-85046, a type confusion in V8's JIT compiler, Chrome's JavaScript engine. According to Google's advisory, the vulnerability carries a CVSS 8.8 HIGH rating with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

After initial execution in the browser, the chain continues with a V8 sandbox escape—for which Google does not assign dedicated CVEs, as reported by Ars Technica—and culminates in CVE-2026-85880, a privilege escalation in the Windows kernel. The latter affects older Windows 10 versions, Windows 22, and the initial release of Windows 11, with a CVSS 7.8 HIGH score.

The fix for CVE-2026-85046 landed in the Chromium source repository in early August 2026 but did not reach Chrome stable until September 4, with the release of versions 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. This roughly four-week interval constituted the exploit window documented by Proofpoint.

"There's no way that this is parallel development...The code is practically identical—even the variable naming, the commentary. It's the same kit. One hundred percent." — Mark Kelly, Proofpoint researcher, via Recorded Future News

Four Actors, Same Kit, Different Targets

The first observed use of BlueMoon dates to August 28, 2026, by TA412, a group associated with APT31 and designated by Microsoft as Violet Typhoon. TA412 targeted U.S. non-governmental organizations, mining companies, and commodity traders using fake internship and conference lures, installing the malicious GemStone browser extension.

In the following days, three other groups adopted the same kit with distinct infrastructure and malware. UNK_LateNight hit the U.S. aerospace and defense sector with procurement-themed lures, deploying the ShadowPad backdoor. UNK_DoubleCheck compromised a Vietnamese manufacturer via a Southeast Asian government email address, using a Rust-based loader. UNK_QuietRacket targeted government entities in Indonesia and Singapore, consulting firms, and financial organizations with conference invitations, assessed as likely Chinese-aligned.

The attribution discrepancy is significant: while TA412 is identified as a Chinese state actor and UNK_QuietRacket is assessed as "suspected" Chinese, UNK_DoubleCheck remains without confirmed attribution. Proofpoint documented no infrastructure overlaps linking the latter group to known Chinese operators at this time.

AI in the Development Cycle: Clues and Limits

Proofpoint researchers spotted artifacts suggesting the use of AI tools in writing the exploit code. These include unusually verbose debug comments, a markdown "handover" document designed to transfer context between AI work sessions, and references to Google's v8CTF bug bounty framework.

Mark Kelly publicly commented that "people on Twitter are reverse-engineering these Chromium patches to develop working exploits using AI...It's pretty good, because it's open-source code." The source does not, however, establish the precise nature of the v8CTF references: it is not determined whether they represent genuine bounty program research or a technique to bypass AI tool safety guardrails.

Proofpoint researchers emphasized that the indication of AI assistance is circumstantial, not definitive. The brief does not specify whether AI generated critical components of the exploit chain or merely accelerated ancillary development phases.

Google Halves Chrome's Release Cycle

In response to the documented dynamic, Google announced on September 8, 2026, a transition to a two-week Chrome release cycle, halving the previous roughly four-week interval. CVE-2026-85046 is the sixth Chrome zero-day patched in 2026, following CVE-2026-11645, CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.

The decision to accelerate releases responds to a quantitative shift in risk: the patch-gap window, exploited before, now appears compressible to machine speed through automated source-code analysis. Kelly noted that "because of the patch-gap dynamic, where there was a patch coming, it seems like that pushed a lot more toward the need to get it out as fast as possible."

The element that surprised researchers is the crudeness of the post-exploitation stages. BlueMoon uses the command-line curl utility to download subsequent payloads—a choice that generates high detection signals and distinguishes the kit from historically more sophisticated exploit chains that employ integrated stealth download mechanisms.

Immediate Actions

• Immediately update Chrome, Edge, and every Chromium-based browser to version 152.0.7977.82 or later, verifying the exact number on the chrome://help page
• Review network logs for anomalous curl connections originating from browser processes, which Proofpoint identifies as a BlueMoon compromise signal
• Check for unauthorized browser extensions, paying particular attention to those named similarly to "Gemini" or "GemStone," in Chrome's extension manager
• Realign patching cycles for legacy Windows systems, prioritizing the fix for CVE-2026-85880 on Windows 10 and early Windows 11 versions

Why the Chromium Patching Model Is Under Pressure

The sharing of BlueMoon among four groups in a matter of days upends the assumption that browser exploit chains represent costly, hard-to-replicate capabilities. Proofpoint described the kit as "fully weaponized" but distributed with "high detection signals"—a combination that traditionally would not appear across multiple actors simultaneously.

The patch-gap mechanism is not new, but its compression through automated source-code analysis tools changes its frequency of use. Google's decision to accelerate releases acknowledges that the previous roughly four-week interval is no longer defensible against actors who can operate at the speed of open-source commit publication. What remains unclear is the kit's distribution channel: the brief does not specify whether BlueMoon originated from a shared contractor, a commercial platform, or direct state distribution.

Sources

• https://therecord.media/china-hackers-chrome-browser-zero-day-multiple-groups
• https://thehackernews.com/search/label/zero-day
• https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/
• https://arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/
• https://cybersecuritynews.com/bluemoon-exploit-chain/
• https://securityaffairs.com/198495/breaking-news/security-affairs-newsletter-round-593-by-pierluigi-paganini-international-edition.html
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence
• https://thehackernews.com/search/label/Vulnerability

Frequently Asked Questions

Can I be sure I'm not at risk if Chrome updates automatically?

Automatic updates reduce risk but do not eliminate it. If the system ran Chrome during the patch-gap window (early August – September 4, 2026), compromise could have occurred before the patch was installed. Verifying network logs for anomalous curl connections is recommended.

Why doesn't Google patch Chromium and Chrome simultaneously?

Chromium is open-source and its public repository receives commits that are immediately visible. Chrome stable requires additional testing, integration with proprietary components, and distribution via update channels. The brief documents that this interval was roughly four weeks, reduced to two as of September 8, 2026.

What distinguishes BlueMoon from other browser exploit kits?

The documented sharing among four distinct APT groups within days, with an identical codebase but different command-and-control infrastructure and final payloads. According to Proofpoint, this pattern is unusual for browser exploit chains, historically considered high-cost, low-diffusion capabilities.

Information verified against cited sources and current as of publication.

Sources