Attackers are weaponizing the gap between Chromium fixes and Chrome patches

A new exploit kit is revealing the perils of the “patch later” mentality.

According to the Proofpoint Threat Research team, espionage-motivated threat actors are using a new malicious toolkit to chain together four separate Chrome browser and Microsoft Windows vulnerabilities to allow them to launch targeted spear phishing campaigns.

Proofpoint, which researched the new attack method along with Google’s Threat Intelligence Group, Microsoft’s Threat Intelligence Center, and cybersecurity company Volexity, has dubbed it BlueMoon.

“BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals,” Proofpoint noted. It offers a low cost and low barrier to entry for attackers who are increasingly using AI agents to enhance their tradecraft.

The BlueMoon attack chain

BlueMoon strings together three different flaws in Chrome and Chromium-based browsers: A type confusion vulnerability (CVE-2026-85046) in Chromium’s open-source V8 JavaScript engine; a V8 sandbox escape (CVE-2026-87491) due to a WebAssembly defect; and a Windows kernel Local Privilege Escalation (LPE) zero-day found in older Windows builds (CVE-2026-85880). All three vulnerabilities are rated high severity.

Chaining CVE-2026-85046 and CVE-2026-87491 essentially allows attackers to run arbitrary code inside Chrome via a click on a phishing link, explained Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group. Adding CVE-2026-85880 “exponentially worsens the impact” by leveraging a Windows kernel exploit to elevate privileges on older Windows instances (Windows 10 22H2, Windows 11 21H2).

“Basically, BlueMoon enables threat actors to gain full Windows admin privileges in one click, and install whatever malware they want on an endpoint,” Ioussoufovitch said.

Both V8 vulnerabilities are “patch-gap” zero-days; they were known and fixed in public upstream source code, but remained unpatched in later stable releases of Chrome and Chromium-based browsers, Proofpoint explained.

CVE-2026-85046 was first reported to the Chromium project by a security researcher on August 4. A fix was added to the open source Chromium codebase, which essentially serves as the foundation for Google Chrome and Chromium-based browsers. But because the fix had not yet reached newer versions of Google Chrome, there was an “unusual patch gap,” the researchers said.

During that window, threat actors, whose ability to build exploit kits has been “wildly accelerated” by AI, likely had time to reverse engineer exploits from the open source codebase and take advantage of what used to seem like a reasonable patch gap, Ioussoufovitch explained.

“Attackers are acting faster, and that means each day a patch is delayed carries more risk than it used to,” he said.

Effectively, at the Chromium source level, it was an N-day vulnerability (it was known and had an available patch), but in Google Chrome, it was effectively a zero-day (previously unknown) flaw, the Proofpoint threat team pointed out, noting, “a fully weaponized Chrome exploit chain has historically been a high-value, rare capability.”

Building rapport to spear phish victims

In one example, a China-aligned state-sponsored threat actor used the BlueMoon kit to target a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the US.

They launched spear phishing campaigns using a range of lures: Posing as university students interested in internships at the organization; outreach regarding upcoming conferences; and even “target-specific rapport-building exchanges” that duped some users into clicking a phishing link. If they did, they were led to an actor-controlled domain, shown a loading page for several seconds as the threat actor attempted the exploit, then were directed to legitimate websites (like GitHub).

This particular campaign began on August 28, and, Proofpoint explained, “within days, several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus.”

Proofpoint predicted that BlueMoon will “likely proliferate further and be adopted by both espionage-motivated and financially motivated threat actors.”

The fact that BlueMoon was used in four separate attack clusters makes it look “less like a specialized weapon and more like reusable infrastructure,” agreed Nick Tausek, lead security automation architect at Swimlane.

He pointed out that increased breadth doesn’t necessarily mean attackers are stretching themselves thin. “A modular exploit kit lets different groups chase different objectives without rebuilding the attack chain from scratch,” he noted. Further, one exploit path can surface across industries with completely different risk profiles.

“BlueMoon may cast a wide net, but defenders still need to know where it can hurt [victims] most,” Tausek said.

For this specific attack, the fix is straightforward, Ioussoufovitch noted: Patch Chrome and Windows immediately, apply the detection rules Proofpoint has provided, and be sure to re-scan infrastructure for any artifacts linked to the kit, because anything installed by BlueMoon, such as Chrome extensions, scheduled tasks, or registry keys, won’t be removed by the patches.

“More broadly, the industry needs to remain on high alert,” he said. Vendors are patching faster, and organizations need to increase their patching cadence accordingly.

Since many of these attacks are still exploited through social engineering, awareness training also matters, Ioussoufovitch said. However, he acknowledged: “Realistically though, the pace of AI advancement is making user awareness training a losing battle.”