BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
C SecurityWeek ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
Bundling several already-patched zero-days into a circulating exploit kit lets even less skilled espionage-motivated actors exploit them, making the window between patch availability and patch deployment the decisive risk factor.
Description
The BlueMoon exploit kit chains several recently patched zero-days into a single exploit chain: CVE-2026-85046 and CVE-2026-87491 in Google Chrome's V8 JavaScript and WebAssembly engine, plus CVE-2026-85880, a privilege escalation in Windows Advanced Local Procedure Call (ALPC). All three were patched in September 2026 as actively exploited zero-days, the Chrome flaws on September 3 and 8, the Windows flaw during September Patch Tuesday. Multiple espionage-motivated threat actors are deploying the kit in opportunistic, rushed campaigns. It is currently unknown how the different actors obtained access to the exploit kit. An exploit kit bundles the exploitation of multiple vulnerabilities, thereby lowering the barrier to entry for a broad set of actors.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 15.00
- industry weight
- 1.10
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
- consensus penalty
- -3.00
Path: operational
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
TTP_SKIPPEDTTP mapping skipped (placeholder or aggregation article) −3
- Consensus penalty:
- −3.0
- Total penalty:
- −3.0