Chinese Espionage Groups Exploit BlueMoon Chrome-to-Windows Zero-Day Chain
Active Exploitation · 12 sources · Updated 2mo ago · First seen Sep 21, 2026
Proofpoint reported that the BlueMoon exploit kit chains three vulnerabilities to compromise Windows systems through Google Chrome: CVE-2026-85046, a V8 arbitrary-code-execution/type-confusion flaw; CVE-2026-87491, a V8 sandbox escape; and CVE-2026-85880, a Windows ALPC local privilege-escalation vulnerability. First observed on August 28 in China-linked TA412 operations targeting U.S. NGOs, mining companies, and commodities-trading firms, the kit was adopted by multiple espionage groups within days, exploiting the gap between Chromium source-code fixes and stable-browser patch deployment.
Chinese actors identified as UTA0560 and JungleBamboo (APT31) used the Chrome-to-Windows chain in targeted spear-phishing against NGOs. UTA0560 deployed the GRIMWEDGE JScript backdoor, while JungleBamboo used SUPERSTOMP to install the LONGTALE credential-stealing Chrome extension. Organizations should prioritize Chrome and Windows security updates, investigate targeted phishing activity involving Chrome exploitation, and hunt for the named payloads and unauthorized browser extensions, particularly in NGO, mining, and commodities-trading environments.
