Published Saturday, September 12, 2026 at 05:14 AM PT
BLUF: BlueMoon exploit kit is actively exploiting unpatched zero-day vulnerabilities in Google Chrome and Windows. Multiple state-aligned threat actors have rapidly adopted the kit for targeted espionage operations. All organizations running unpatched Chrome and Windows require immediate patching.
DETAILS
BlueMoon kit confirmed operational. The exploit kit chains vulnerabilities in Chrome and Windows, with active exploitation confirmed in the wild. Attackers are targeting multiple sectors across unknown geographic scope.
Chrome CVE-2026-85046 (type-confusion vulnerability) under active exploitation. Google has released patches; systems remain vulnerable if not updated to current stable release.
Windows zero-day component confirmed but unpatched. Specific CVE designation not yet disclosed in public reports. Windows systems remain vulnerable to the kit’s secondary payload.
State-aligned threat actors adopting rapidly. Proofpoint reports multiple espionage-motivated threat actors (likely nation-state or state-sponsored) have incorporated BlueMoon into active campaigns within days of kit availability.
Patch gap being weaponized. Attackers are exploiting the known window between Chromium upstream security fixes and Chrome stable channel deployment, providing 24–72 hour attack window against patched Chromium users still on older Chrome stable builds.
IMPACT
- Who: Any organization or individual running unpatched Chrome (pre–CVE-2026-85046 patch) or current Windows without latest security updates.
- What: Remote code execution; attackers gain code execution in Chrome sandbox, can pivot to Windows kernel exploitation for privilege escalation and lateral movement.
- Scope: Multiple sectors confirmed targeted. Risk is highest for government agencies, defense contractors, critical infrastructure, and high-value tech companies. Consumer risk present but secondary to targeted campaigns.
RECOMMENDED ACTIONS
- Immediate (within 24 hours): Update Chrome to latest stable version. Verify CVE-2026-85046 remediation in release notes.
- Immediate (within 24 hours): Apply latest Windows patches (September 2026 or newer). Do not defer.
- Monitor: Watch for Chrome and system processes initiating unexpected network connections, spawning child processes, or accessing sensitive files.
- High-risk environments: Disable Chrome entirely until verified patched, or require isolated/sandboxed use only.
- Threat intelligence: Brief security teams on BlueMoon indicators of compromise once published by Proofpoint or CISA.
SOURCES
- Proofpoint: “Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain”
- Google Chrome Security / BleepingComputer: CVE-2026-85046 active exploitation confirmation
- CSO Online: Patch gap weaponization details
- News4Hackers: BlueMoon kit overview and sector targets
Recent high-severity events at publish time:
