Four espionage-focused groups deployed the same Chrome-to-Windows exploit chain during a 12-day window that started 28 August 2026. Proofpoint tracks the tooling as BlueMoon and investigated it with contributions from Google’s Threat Intelligence Group, Microsoft’s MSTIC, and Volexity. The sequence links CVE-2026-85046 in Chrome V8 to a V8 sandbox escape and then to CVE-2026-85880 in the Windows kernel, and was built and reused during a patch-gap period before the September 3 stable Chrome release.
How the chain gains code execution
The package joins three stages into one flow from web content to system commands. The initial flaw, CVE-2026-85046, is a type-confusion error in the Chrome V8 JavaScript engine connected to the TurboFan JIT compiler. Manipulation of an array while a sort operation is in progress can expose internal object addresses and permit creation of counterfeit object references, which then leads to uncontrolled memory access inside the V8 heap.
A second V8 issue provides exit from the sandbox. No CVE identifier exists for that part because Chrome does not assign CVEs to sandbox escapes. It replaces compiled WebAssembly function code in memory with attacker-controlled machine code. The final stage, CVE-2026-85880, is a local privilege problem in the Windows kernel that uses ALPC and Windows Notification Facility behavior. It moves the attacker out of the sandboxed renderer, allows insertion of code into the parent Chrome process, and permits execution of arbitrary system commands.
Patch-gap window enabled reuse
Both V8 flaws were already corrected in public upstream Chromium code when the attacks occurred, but the corrections had not yet reached publicly available stable builds of Chrome and other Chromium-based browsers. Proofpoint assesses the kit author likely turned those visible Chromium fixes into a working browser chain.
The correction for CVE-2026-85046 entered the Chromium tree on August 7, almost four weeks before it shipped in the stable Chrome release on September 3. That public interval disclosed the underlying error and created an opportunity for fast weaponization.
Construction clues
No single object proves automated or AI-assisted creation, but Proofpoint describes several signs pointing in that direction. The kit contains broad diagnostic logging, long explanatory comments that record debugging attempts and design choices, and a pointer to an external markdown handover file.
Test instructions inside the kit ask for return of complete logs, rendered here exactly as a short token:
please send the full log back.
The referenced handover path is:
docs/v8-ctf-chrome-stage4-handover.md
That name, plus repeated references to Google’s V8CTF vulnerability bounty program, suggests two possibilities noted by researchers: the V8 flaws were prepared through that program, or its materials were used to shape prompts and bypass safety controls during exploit creation. Researchers state they cannot confirm either account.
Default operational behavior is unusually noisy for a browser chain of this type. A successful run falls back to fetching an operator-supplied binary with curl, writing it to disk and launching it. The default destination directory is:
%TEMP%
That pattern would be readily noticed by endpoint tools, indicating priority on use before the September 3 patch rather than stealth.
Campaign timeline and payloads
The earliest observed operator was TA412, also listed as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE. It is described as a China-nexus group tied to the Ministry of State Security’s Hubei State Security Department and indicted by the US government in 2024 for economic espionage. Starting August 28, it sent phishing messages aimed at US NGOs, mining companies, and physical commodity trading firms. The lures pretended to come from university students looking for internships or concerned outreach for the Association for Asian Studies conference. A click opened BlueMoon without visible signs and then sent the browser to a legitimate page while exploitation continued.
TA412 installed GemStone, a malicious browser add-on posing as:
AI-powered browsing companion by Google Gemini
It targets Chrome, Edge, Brave, and Vivaldi and defeats Secure Preferences protection by reproducing the same HMAC calculation the browser uses for extension validation. GemStone can collect keystrokes, cookies, screenshots, local and session storage, and browsing history, and can issue arbitrary HTTP requests using the browser identity. Command and control runs through a Cloudflare Worker domain, with the full command list included in the Proofpoint report.
On September 2, a second suspected China-aligned group, UNK_LateNight, directed false RFQ and procurement messages at US aerospace and defense companies. Its implant was ShadowPad, a modular backdoor widely associated with Chinese state operations. Delivery relied on DLL sideloading, created persistence with a scheduled task named:
EdgeCore_AutoUpdate
and disabled visibility by unhooking 20 network monitoring functions.
The same day, UNK_DoubleCheck approached a Vietnamese manufacturing company from a compromised Southeast Asian government email address using a vaccination appointment theme. Its flow pulled a Rust-based loader from Cloudflare R2, which then started another DLL sideloading sequence for command and control.
Since September 3, UNK_QuietRacket has focused on government, consulting, and financial organizations in Indonesia and Singapore with conference-themed lures. Its infrastructure queries Google’s DNS-over-HTTPS service for TXT records, decrypts the answers with ChaCha20, and then contacts Cloudflare Workers. Use of DoH blends lookup traffic with ordinary encrypted web activity.
Patch research and proof-of-concept references
Authoritative records for the V8 entry flaw are available in the NVD record for CVE-2026-85046 and the CVE.org record for CVE-2026-85046. Related context on active Chrome exploitation appears in the CISA KEV catalog update covering Chromium V8 and the report on actively exploited Chrome zero-day fix.
A public study repository is provided as the conceptual patch repository for CVE-2026-85046. It frames the issue as a high-severity type confusion in V8's Maglev and Turbofan compilers, where an array holding generic PACKED_ELEMENTS incorrectly takes a PACKED_SMI_ELEMENTS map, permitting read and write of arbitrary pointers on the JavaScript heap. The repository lists two files:
v8_type_confusion_fix.cpp
ABOUT.md
The first illustrates structural C++ logic for enforcing map checks to block element-type mix-ups. The second gives background on the flaw and its scope. The material is described as educational and research-only for browser engine work on the Turbofan/Maglev pipeline. For users, it directs Chrome Stable updates to version 152.0.7977.82/.83 on Windows/macOS or 152.0.7977.82 on Linux through Help > About Google Chrome.
Detection and mitigation
Update Chrome and other Chromium-based browsers immediately, including Chrome, Edge, Brave, and Vivaldi installations that could load GemStone. Apply the Windows fix for CVE-2026-85880 to close the kernel escalation path, and treat any system that browsed a lure link on the dates above as potentially compromised even if it later redirected to a benign site.
Look for the behaviors described in the source material: silent browser exploitation followed by navigation to a legitimate page, curl retrieval of an operator binary into %TEMP% and execution from there, unexpected browser extensions claiming AI assistance, Secure Preferences validation anomalies, creation of the EdgeCore_AutoUpdate scheduled task, DLL sideloading chains, unhooking of network inspection routines, Rust loaders staged from Cloudflare R2, and DNS-over-HTTPS TXT lookups that decrypt to Cloudflare Workers addresses with ChaCha20. Review phishing vectors involving internship requests, Association for Asian Studies conference outreach, RFQ and procurement inquiries, vaccination appointments, and conference invitations aimed at the sectors and regions listed for TA412, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket.
Technical background
This section is general explanation only, not findings about BlueMoon. It uses generic illustrations.
Type-confusion flaws in JIT-compiled JavaScript occur when optimized code assumes an object layout that attacker-influenced operations later change. A classic generic pattern is a map or element-kind check omitted on a fast path, allowing one representation to be misread as another and turning a type error into memory address disclosure and pointer forgery.
Generic defensive checks for this class often look like this in concept, not actual BlueMoon code:
# Generic illustration only - not BlueMoon code
# Verify element-kind/map before fast-path access
# If map != expected_map: take slow path / deoptimize
# Isolate untrusted renderer, enforce sandbox, patch JIT
Operators commonly monitor noisy downloader behavior with generic host telemetry, for example listing recently created scheduled tasks or reviewing processes that fetch executables into temporary directories. Such steps are standard hygiene for any browser-chain incident and do not imply specific BlueMoon indicators beyond those stated above.