BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days in Rapid Espionage Campaigns

Key points

• Google released updates for Chrome versions 153.0.8010.36/.37 to fix 230 flaws, including the actively exploited out-of-bounds write in V8 (CVE-2026-87491).
• Proofpoint identified the 'BlueMoon' exploit kit, which chains CVE-2026-87491, CVE-2026-85046, and a Windows kernel LPE flaw (CVE-2026-85880) to achieve remote code execution and privilege escalation.
• The kit was rapidly adopted by four threat clusters, including TA412 (China-aligned), UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, targeting organizations in the US, Vietnam, Singapore, and Indonesia.
• The exploits leveraged a 'patch gap' where fixes were available in upstream Chromium source but not yet in stable browser releases, creating a window for weaponization.
• Proofpoint noted indicators of AI-assisted development in BlueMoon, including verbose debugging comments and markdown handover documents, suggesting a lowered barrier to entry for complex exploit chains.

Background

This incident follows a series of actively exploited Chrome zero-days in 2026, including CVE-2026-85046 patched in September. The current update marks the seventh actively exploited Chrome zero-day addressed this year. Previous incidents, such as the Zimbra and GeoServer zero-days, highlight a broader trend of rapid exploitation of unpatched or newly disclosed vulnerabilities across various software platforms.

How outlets are covering it

The Hacker News focuses on the technical details of the CVE-2026-87491 patch and Google's restriction of exploit details until widespread adoption. Proofpoint provides a detailed threat intelligence analysis, identifying the 'BlueMoon' kit and attributing its use to multiple state-aligned actors, emphasizing the role of AI in accelerating exploit development. Ars Technica highlights the 'patch gap' phenomenon and the rapid, visible nature of the attacks, contrasting them with traditional stealthy campaigns. The Hong Kong CERT rates the risk as 'Extremely High' due to active exploitation of CVE-2026-85046, urging immediate updates to Chrome 152.0.7977.82 or later, though this version predates the latest 153.0.8010.36 release mentioned by other sources.

Why it matters

The rapid adoption of the BlueMoon exploit kit by multiple state-sponsored groups signals a shift in threat landscape dynamics, where AI-assisted development and open-source patch gaps enable faster weaponization of vulnerabilities. This increases the risk for organizations using older Windows builds and unpatched Chromium-based browsers, necessitating immediate updates and enhanced monitoring for browser-based attacks.

What to watch

Users should update Chrome to version 153.0.8010.36/.37 on Windows and macOS, and 153.0.8010.36 on Linux, as soon as possible. Organizations should monitor for signs of browser-based exploitation, particularly on older Windows builds, and ensure that all Chromium-based browsers are patched. Security teams should review logs for anomalous browser activity and potential credential theft via malicious extensions.