Security researchers at Proofpoint have identified a fully weaponized exploit kit named BlueMoon that chains critical vulnerabilities in Chromium-based browsers and older Windows versions, and at least four distinct hacking groups are already using it. The kit appeared, spread, and was adopted by multiple threat actors within days, a pace that has startled researchers who have historically treated fully built Chrome exploit chains as rare, closely guarded capabilities.
What BlueMoon Attacks
The kit chains three vulnerabilities: two in V8, Google's open source JavaScript engine used by Chrome, Edge, and other Chromium browsers, and one in the Windows kernel. The first V8 flaw is a type confusion bug. The second is a sandbox escape in V8. Together they allow remote code execution. The Windows kernel bug is a local privilege escalation that lets the attacker's code run with system-level rights.
Affected Windows versions include Windows 10 (October 2018 Update), Windows Server 2019, Windows 10 version 2004, Windows Server 2022, and the initial release of Windows 11. The V8 vulnerabilities are tracked as CVE-2026-85046. The Windows bug is CVE-2026-85880. Google does not assign CVE designations for V8 sandbox escapes. All three have been patched, but at the time of the attacks, they were patch-gap zero-days, meaning the fixes existed in public upstream Chromium source code but had not yet made it into the stable browser releases most users run.
How the Kit Spread
Exploit chains targeting Chrome have historically been high-value, rare capabilities. Groups that develop them tend to use them sparingly to avoid detection and preserve their lifespan. BlueMoon broke that pattern. Proofpoint described the kit as developed, deployed rapidly, and shared across multiple threat actors within days, with high detection signals along the way.
The company identified two factors behind the speed. The first is the patch gap in the Chromium supply chain. When a patch lands in the public source repository, it creates a window where attackers can reverse-engineer the fix and build an exploit before downstream browsers incorporate it. The second factor is AI. Proofpoint said AI agents increasingly enable threat actor exploit development, and open source codebases like Chromium are particularly exposed because the patches are publicly accessible before consumers apply them.
The implication is that the traditional model of exploit development, where skilled developers spend weeks or months finding and weaponizing a vulnerability, is compressing. The barrier to entry for building a Chrome exploit chain is dropping, and the speed at which an exploit can move from discovery to deployment is accelerating.
The Four Groups Using It
Proofpoint identified four distinct threat actors, each with different targets and affiliations.
TA412 is a China-aligned state-sponsored group that was indicted by the US government in 2024 on charges related to working on behalf of China's civilian foreign intelligence agency. Its BlueMoon attacks targeted non-governmental organizations, mining companies, and commodity trading firms in the United States. The first recorded attack from TA412 began on August 28.
UNK_LateNight is a second China-aligned espionage group. Its targets were multiple US aerospace companies.
UNK_DoubleCheck focused on a Vietnamese manufacturing entity.
UNK_QuietRacket operated against targets in Singapore and Indonesia.
The remaining attacks began in early September. Proofpoint said it is unknown whether additional groups have also gained access to the kit.
Why It Matters
The speed of adoption is the headline. A single exploit kit, targeting the browser and operating system used by billions of people, was built and shared among four groups with different objectives in a matter of days. State-sponsored espionage actors and potentially financially motivated groups are using the same tooling, at the same time, against targets across multiple countries.
The patch gap is the structural vulnerability. Chromium's open development model is a strength for security research, but it also means every fix is public before it ships to users. Attackers who watch the repository can extract the patch, understand the vulnerability, and build an exploit while the gap between upstream and downstream remains open. That gap has always existed, but the time it takes to close it has compressed as AI-assisted vulnerability discovery speeds up the process.
For defenders, the practical reality is that patching speed matters more than it used to. The window between a Chromium patch landing and an exploit appearing in the wild is shrinking. Organizations running Chromium-based browsers and older Windows versions need to apply updates as soon as they are available, not on a delayed maintenance cycle.
Proofpoint warned that despite the high detection signals, BlueMoon is likely to proliferate further as patched versions roll out across all Chromium-based browsers. The kit's ease of adoption makes it attractive to both espionage-motivated and financially motivated actors. The exploit chain's existence in the wild, shared openly among groups, suggests that the era of Chrome exploit chains as rare, closely held weapons is ending.
The combination of open source patch visibility, AI-assisted exploit development, and rapid tool-sharing among threat actors is producing a new dynamic. Security teams should plan accordingly.