BlueMoon: Nation-State Hackers Chain Three CVEs Through Chrome

Last week, Proofpoint researchers published a report called "Once in a BlueMoon" that should be required reading for anyone who manages Windows computers — which is to say, nearly every business. Four separate China-aligned hacking groups deployed an identical exploit kit, named BlueMoon, across a 12-day window between August 28 and September 9, 2026. The kit chains three vulnerabilities in sequence: two separate flaws in Chrome's V8 JavaScript engine followed by a Windows kernel privilege-escalation bug. A phishing email is all it takes to start the chain. Full OS-level control is where it ends.

How the Chain Works

BlueMoon is not a single vulnerability — it is a three-stage payload delivery system that uses vulnerabilities at each step to move from an untrusted website into the Windows kernel.

Stage one — CVE-2026-85046 (Chrome V8 type confusion). A crafted HTML page causes Chrome's V8 engine to misidentify the type of a JavaScript object, creating an arbitrary read/write primitive inside the browser's renderer process. This gives an attacker controlled memory access within the browser sandbox. Google patched this on September 3 as the sixth actively exploited Chrome zero-day of 2026; CISA set a federal patch deadline of September 18.

Stage two — CVE-2026-87491 (Chrome V8 out-of-bounds write). This is the sandbox escape. BlueMoon overwrites WebAssembly function bodies to inject a reconnaissance DLL, then pivots into Chrome's privileged broker process. Without this second flaw, the attacker is stuck inside the renderer sandbox with no path to the operating system. Google patched this on September 8 in Chrome 153.0.8010.36; CISA's deadline for federal agencies is September 23.

Stage three — CVE-2026-85880 (Windows kernel LPE). Once code is running in Chrome's broker process, the kit exploits a Windows kernel flaw via ALPC and the Windows Notification Facility to elevate from a browser-level process to full administrative privileges. This is the same zero-day Microsoft patched in the September 2026 Patch Tuesday release. It affects Windows 10 through 22H2, Windows 11 21H2, and Windows Server 2019 and 2022. Fully patched systems are not vulnerable to stage three, but stages one and two can still succeed without it if the attacker is satisfied with renderer-level code execution.

Four Groups, Twelve Days, Nearly Identical Kits

What makes BlueMoon unusual is not the sophistication of any individual CVE — it is the speed and breadth of adoption. Proofpoint identified four distinct threat clusters using functionally equivalent versions of the kit within two weeks:

• TA412 (also known as APT31 / Violet Typhoon) — first observed using BlueMoon on August 28, targeting US-based NGOs, mining companies, and commodity traders. TA412 is a well-documented People's Republic of China-sponsored actor.
• UNK_LateNight — China-aligned, active September 2, targeting the US aerospace and defense industrial base.
• UNK_DoubleCheck — suspected espionage motivation, active September 2, hitting Vietnamese manufacturing firms.
• UNK_QuietRacket — China-aligned, active September 3, targeting Indonesian and Singaporean government, consulting, and financial organizations.

That four independent groups converged on the same toolkit inside 12 days points to a shared access model — either a common broker sold them the kit, or a single developer produced it for multiple buyers simultaneously. This is increasingly how nation-state tooling works: centralized exploit development, distributed operation.

What Gets Installed

The malware dropped at the end of the chain varies by actor, but the standouts are notable. TA412 deployed GemStone, a browser extension disguised as Google Gemini. GemStone enables keylogging, credential harvesting, and long-term surveillance inside the browser — invisible to most endpoint tools because it runs as a browser extension with user-level permissions. UNK_LateNight dropped ShadowPad, a modular backdoor with network monitoring capability that has appeared in multiple PRC-attributed intrusions over the past four years. Others used custom Rust-based loaders running DLL-sideloading chains designed to evade signature detection.

Why This Concerns Businesses That Are Not Defense Contractors

The current confirmed targets skew toward government, defense, and NGO sectors. That does not mean smaller businesses are safe — it means smaller businesses are probably next on a different group's list. Exploit kits like BlueMoon follow a predictable lifecycle: state actors develop them, use them for espionage, and eventually the techniques leak or get repurposed by ransomware affiliates who have no interest in nation-state geopolitics but every interest in credential theft and financial extortion. GemStone, the browser-based credential harvester, is exactly the kind of tool ransomware groups would pay for. Any organization running Chrome on Windows — which covers virtually every office in the country — is in the affected population.

The delivery mechanism is also worth noting: spearphishing emails linking to attacker-controlled domains. Not a sophisticated corporate compromise. A single employee clicking a link in an email they half-trusted.

What to Do Now

• Update Chrome immediately. You need version 153.0.8010.36 or later on Windows and macOS (153.0.8010.36 on Linux). Open Chrome, go to chrome://settings/help, and let it update. Verify the version number after restart. This closes both CVE-2026-85046 and CVE-2026-87491 — stages one and two of the chain.
• Apply September 2026 Patch Tuesday. CVE-2026-85880, the Windows kernel LPE, was patched in the September 8 cumulative updates for Windows 10, 11, and Server 2019/2022. If your systems haven't been updated since last week, change that today.
• Audit Chrome extensions. GemStone masquerades as a legitimate productivity tool. Review which browser extensions are installed across your organization. If an employee's Chrome has an AI assistant extension that nobody approved, treat it as suspicious.
• Treat phishing-awareness training as infrastructure, not a checkbox. The initial access vector for every BlueMoon intrusion was an email link. Technical controls matter, but users who recognize suspicious links stop attacks before the browser ever sees a malicious payload.

This is why patch cadence matters even when nothing has obviously gone wrong yet. At Falcon Internet, our 24x7x365 NOC monitoring picks up unpatched browser versions across managed systems the same way it catches an expired certificate — not because we're expecting an attack, but because patch gaps are how attacks become incidents.

Chrome updates silently on most systems when restarted. The question is whether your users actually restart it. Given what's riding on that question right now, it's worth confirming.