cybersecurity1 month ago
BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days in Rapid Espionage Campaigns
Google patched 230 vulnerabilities, including the actively exploited V8 sandbox escape CVE-2026-87491, in a major Chrome update. Security firm Proofpoint identified a new exploit kit named 'BlueMoon' that chains this flaw with a type-confusion bug (CVE-2026-85046) and a Windows kernel privilege escalation flaw. At least four espionage-motivated groups, including China-aligned actor TA412, rapidly adopted this kit to target US NGOs, aerospace, and mining sectors. The attacks exploited a 'patch gap' where upstream fixes were public before stable browser releases, likely aided by AI-assisted development.