Hackers Chain Chrome and Windows Zero

Cybersecuritynews •Guru Baran • September 9, 2026

Multiple espionage-motivated threat actors have rapidly adopted a newly discovered exploit kit that chains Chrome browser and Microsoft Windows vulnerabilities to deploy backdoors and surveillance tools against government, defense, and commercial targets worldwide. Security researchers at Proofpoint have named the kit “BlueMoon,” identifying its use by at least four distinct threat clusters since late August […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by other groups within days. The exploit kit chains three vulnerabilities: CVE-2026-85046, a type confusion flaw in Chrome's V8 JavaScript engine, a V8 sandbox escape, and CVE-2026-85880, a Windows local privilege escalation vulnerability. The exploit takes advantage of a four-week patch gap, allowing attackers to reverse-engineer fixes before they are applied to stable releases. The targeted sectors include U.S. defense contractors, NGOs, and Southeast Asian government agencies. Microsoft and Google have since released patches for the vulnerabilities. The situation remains dynamic, with ongoing investigations into the extent of the exploitation and the actors involved. 26 sources 81

Extracted Entities

Hackers Chain Chrome and Windows Zero

The full story

Extracted Entities

Attack Types (1)

Industries (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)