Skip to content
Auto-CTI
Back to today
NEW HIGH C3

BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

C SecurityWeek ·

Admiralty grading (A–F · 1–6)

Source reliability

  • A Completely reliable
  • B Usually reliable
  • C Fairly reliable
  • D Not usually reliable
  • E Unreliable
  • F Cannot be judged

Information credibility

  • 1 Confirmed
  • 2 Probably true
  • 3 Possibly true
  • 4 Doubtful
  • 5 Improbable
  • 6 Cannot be judged

NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.

Key insight

Bundling several already-patched zero-days into a circulating exploit kit lets even less skilled espionage-motivated actors exploit them, making the window between patch availability and patch deployment the decisive risk factor.

Description

The BlueMoon exploit kit chains several recently patched zero-days into a single exploit chain: CVE-2026-85046 and CVE-2026-87491 in Google Chrome's V8 JavaScript and WebAssembly engine, plus CVE-2026-85880, a privilege escalation in Windows Advanced Local Procedure Call (ALPC). All three were patched in September 2026 as actively exploited zero-days, the Chrome flaws on September 3 and 8, the Windows flaw during September Patch Tuesday. Multiple espionage-motivated threat actors are deploying the kit in opportunistic, rushed campaigns. It is currently unknown how the different actors obtained access to the exploit kit. An exploit kit bundles the exploitation of multiple vulnerabilities, thereby lowering the barrier to entry for a broad set of actors.

Risk score

17
cvss base
0.00
kev bonus
0.00
epss bonus
0.00
poc bonus
15.00
raw before weight
15.00
industry weight
1.10
freshness factor
1.00
exploitability factor
1.00
days old
0.00
vendor mismatch penalty
0.00
consensus penalty
-3.00

Path: operational

Consensus check

The pipeline self-checks before delivery. These rules lowered the score:

  • TTP_SKIPPED TTP mapping skipped (placeholder or aggregation article) −3
Consensus penalty:
−3.0
Total penalty:
−3.0
ESC