BlueMoon Exploit Kit Highlights Vulnerabilities in Chromium-Based Browsers
The BlueMoon exploit kit illustrates a notable shift in the tactics employed by cyber threat actors, particularly in how they exploit the time between the disclosure of open-source vulnerabilities and their deployment in stable channels. By chaining three specific vulnerabilities—CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880—the kit achieves system-level escalation on Windows systems that utilize Chromium-based browsers. This situation underscores a structural reliance on the patch-gap window, where security fixes are publicly available before they reach end-user environments.
The primary mechanism of this exploit is the four-week interval between the commit of the CVE-2026-85046 fix to the V8 source on August 7, 2026, and its inclusion in the Chrome stable release on September 3. Analysis from Volexity indicates that the developer likely reverse-engineered these publicly available Chromium source patches to construct the exploit. Although the individual vulnerabilities in this chain are classified as medium severity, their combination allows for a complete system compromise. This includes V8 type confusion, which has a CVSS score of 8.8 for remote code execution, followed by a sandbox escape via WebAssembly corruption, culminating in a Windows ALPC kernel local privilege escalation. Once the broker process is injected, the kit executes a simple curl command to download and run a secondary payload.
Within days of the kit's emergence, four espionage-motivated clusters adopted it. These include TA412 (APT31), UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, as documented in Proofpoint's report from September 9. Most of these groups have a nexus to China. TA412, which has been previously indicted for economic espionage on behalf of China’s Ministry of State Security (MSS), utilized the kit to deploy the GemStone browser extension. Posing as Google Gemini, GemStone is designed for credential theft, logging keystrokes, capturing screenshots, and exfiltrating data to a Cloudflare Worker command-and-control infrastructure. The swift adoption of this kit by four distinct groups within a short timeframe suggests a coordinated or shared supply chain for exploit development.
Filed & Cleared
Development artifacts associated with BlueMoon—such as references to a markdown handover file, verbose debugging comments, and v8CTF references—hint at the possible use of AI-assisted development. While this is not conclusive, these indicators align with the decreasing costs associated with exploit creation. This trend becomes particularly relevant as browser-based AI agents become more common. Since these agents operate within the same Chromium V8 engine as the browser, a V8 exploit grants attackers code execution in the exact process where the AI agent functions, effectively providing the attacker with the agent’s permissions and access.
This activity reflects a broader pattern observed in recent intelligence coverage, particularly regarding inference-layer targeting and authentication-layer vulnerabilities. BlueMoon is not an isolated incident but rather a continuation of a structural shift where attackers exploit the transparency inherent in the open-source development lifecycle. As patched versions of Chromium are rolled out, Proofpoint anticipates that the kit will likely proliferate beyond espionage clusters to include financially motivated actors. The simplistic nature of the final payload delivery—relying on basic curl commands—suggests that for these actors, the speed of deployment currently outweighs the need for advanced operational security.
