BlueMoon Exploit Kit Chains Three Zero‑Day Flaws in Windows and Chrome for Remote Code Execution
What Happened — An exploit kit dubbed BlueMoon was observed delivering a chain of three zero‑day vulnerabilities: CVE‑2026‑85046 (Chrome V8 type‑confusion), CVE‑2026‑87491 (Chrome V8 sandbox escape), and CVE‑2026‑85880 (Windows ALPC heap overflow). The kit elevates privileges on vulnerable Windows builds, injects code into the Chrome renderer, and downloads a malicious payload.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of unpatched critical flaws; a continuous vulnerability‑management program must detect, prioritize, and remediate such gaps before an exploit kit can chain them.
- Provides concrete evidence that timely patching and documented remediation are essential control‑assurance artifacts for audits and third‑party risk reviews.
- Highlights the need for automated evidence collection that maps remediation actions to control objectives across frameworks.
Who Is Affected – Organizations that run Windows 10/11 and Chromium‑based browsers, including NGOs, mining firms, and other high‑value targets cited by the threat actors.
Recommended Actions
- Verify patch status for CVE‑2026‑85046, CVE‑2026‑87491, and CVE‑2026‑85880; apply vendor patches immediately.
- Deploy continuous vulnerability scanning that flags unpatched zero‑days on endpoints and browsers.
- Capture remediation tickets, patch‑deployment logs, and verification screenshots as audit‑ready evidence.
Source: BleepingComputer
Technical Notes – The kit uses a Web Worker to retry exploitation up to five times, fingerprints the host, escalates via the Windows ALPC flaw, and then runs a curl command to drop a loader in %TEMP%. Attack vector: vulnerability exploit. CVEs listed above have no public patches at the time of reporting. Source: same as above