BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors

• •BlueMoon exploit kit used by at least four state-aligned threat actors.
• •Exploits vulnerabilities in Chrome and Windows, including CVE-2026-85046 and CVE-2026-85880.
• •Rapid adoption of the exploit kit highlights a concerning trend in cyber espionage.

A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by other groups within days. The exploit kit chains three vulnerabilities: CVE-2026-85046, a type confusion flaw in Chrome's V8 JavaScript engine, a V8 sandbox escape, and CVE-2026-85880, a Windows local privilege escalation vulnerability. The exploit takes advantage of a four-week patch gap, allowing attackers to reverse-engineer fixes before they are applied to stable releases. The targeted sectors include U.S. defense contractors, NGOs, and Southeast Asian government agencies. Microsoft and Google have since released patches for the vulnerabilities. The situation remains dynamic, with ongoing investigations into the extent of the exploitation and the actors involved.