Threat intelligence researchers at Proofpoint have detailed the operations of BlueMoon, a sophisticated and newly identified multi-stage exploit kit that chains together zero-day vulnerabilities in Google Chrome and Microsoft Windows to execute arbitrary code outside the browser sandbox.

The kit surfaced in the wild in late August and early September 2026, when researchers detected its deployment by the China-aligned espionage group APT31 (also tracked as Bronze Vinewood and Violet Typhoon). Within days, three additional distinct threat clusters were observed utilizing the exact same exploit chain, indicating centralized development or private broker distribution across state-sponsored actors.

The Exploit Chain: From V8 Compiler Bug to Kernel Ring 0

The BlueMoon chain relies on a precise two-stage breakthrough designed to overcome modern browser sandboxing and OS-level memory defenses:

  1. Stage 1: Chrome V8 Type Confusion and Out-of-Bounds Write: The attacker delivers a weaponized web page exploiting CVE-2026-85046 and CVE-2026-87491 in Google Chrome's V8 JavaScript and WebAssembly engine. The vulnerability triggers an array type confusion in the TurboFan JIT compiler, allowing the script to corrupt adjacent memory arrays and establish an arbitrary read/write primitive within the sandboxed renderer process.
  2. Stage 2: Windows Kernel Privilege Escalation (LPE): Operating from within the Chrome renderer sandbox, the payload triggers an out-of-bounds memory write in the Windows win32k kernel subsystem. This escalates privileges from the restricted browser sandbox user directly to NT AUTHORITY\SYSTEM, disabling endpoint telemetry and deploying a memory-only implant.

Detection and Enterprise Defense

Because BlueMoon executes in memory without writing binaries to disk, traditional antivirus file scanning fails to detect active intrusions. Security operations teams should implement the following defensive actions:

  • Enforce Immediate Browser Updates: Ensure all enterprise Windows, macOS, and Linux clients are updated to Google Chrome version 153.0.8010.36 or later, or equivalent Chromium-based builds (Microsoft Edge, Brave).
  • Enable Hardware-Enforced Stack Protection: On supported Intel (CET) and AMD (Shadow Stack) processors, enforce hardware stack protection across all browser processes to mitigate return-oriented programming (ROP) chains.
  • Monitor Process Lineage: Configure EDR rules to flag anomalous child processes spawned by chrome.exe or unexpected system-level memory injection originating from renderer threads.