BlueMoon turned a 27 day Chrome patch gap into four espionage campaigns

Four state-aligned espionage groups deployed the same Chrome and Windows exploit chain within days of each other, according to research Proofpoint published on 9 September. The kit, which Proofpoint tracks as BlueMoon, was first seen in the wild on 28 August 2026 in the hands of the China-aligned actor TA412, also known as APT31 and Violet Typhoon.

A fully weaponised Chrome exploit chain has historically been a rare and expensive capability, held by one actor at a time. This one moved across four separate clusters in under a fortnight. The reason it was cheap enough to spread sits in the release schedule of an open source project.

The chain, in three links

BlueMoon strings together three flaws. The entry point is CVE-2026-85046, a type confusion bug in Chrome's V8 JavaScript engine that abuses an optimisation flaw in the TurboFan JIT compiler. By mutating an array mid-sort, an attacker can read object memory addresses and forge fake pointers, building toward arbitrary read and write inside the V8 heap.

The second link is a V8 sandbox escape carrying no CVE, because Chrome does not issue CVEs for sandbox escapes. It overwrites compiled WebAssembly function bodies with attacker shellcode held in memory.

The third is CVE-2026-85880, a Windows kernel privilege escalation that abuses Advanced Local Procedure Call and the Windows Notification Facility. That lifts the attacker out of the sandboxed renderer and into a position to inject code into Chrome's parent process and run arbitrary commands. Microsoft patched it as an actively exploited zero day in its September Patch Tuesday release.

Twenty seven days of public instructions

Both V8 flaws were patch-gap zero days. They were already fixed in public upstream Chromium source and still unpatched in the stable Chrome builds people were running.

The fix for CVE-2026-85046 was committed to the Chromium tree on 7 August. It reached stable Chrome on 3 September. For 27 days, anyone could read a public commit describing precisely what was wrong and where to find it.

Proofpoint's assessment is that the exploit developer used exactly that. This is the structural cost of building a browser in the open. The patch is itself a disclosure, and every downstream consumer of the codebase stays exposed for as long as it takes them to ship.

Four groups, six days

TA412, indicted by US prosecutors in 2024 for economic espionage and linked to the Ministry of State Security's Hubei State Security Department, went first on 28 August. Its lures posed as university students seeking internships and as outreach tied to the Association for Asian Studies conference, aimed at US NGOs, mining firms and physical commodity traders. Clicking the link ran BlueMoon silently, then redirected the browser to a legitimate site while exploitation continued in the background.

Its payload was GemStone, a browser extension masquerading as an "AI-powered browsing companion by Google Gemini". It installs into Chrome, Edge, Brave and Vivaldi by bypassing Secure Preferences using the same HMAC computation the browser itself uses to validate extensions, then accepts commands to capture keystrokes, cookies, screenshots, local and session storage, and browsing history.

UNK_LateNight followed on 2 September against US aerospace and defence companies, using fake requests for quotation to deliver ShadowPad through a DLL sideloading chain. The same day, UNK_DoubleCheck hit a Vietnamese manufacturer from a compromised Southeast Asian government email address. From 3 September, UNK_QuietRacket targeted government, consulting and financial organisations in Indonesia and Singapore, routing command and control through Google's DNS-over-HTTPS service and decrypting TXT record responses with ChaCha20 before reaching Cloudflare Workers.

Proofpoint is careful about attribution. Most observed use is assessed as China-aligned, but some remains unattributed, and the researchers say BlueMoon may not be exclusive to China-aligned actors.

The fingerprints look automated

Proofpoint stops short of confirming AI-assisted development and lists what it found instead: extensive diagnostic logging, comments documenting successive debugging iterations and implementation decisions, and a referenced markdown handover file named docs/v8-ctf-chrome-stage4-handover.md. Comments in the kit ask testers to "please send the full log back".

The code also repeatedly references V8CTF, Google's own V8 bounty programme. Proofpoint offers two readings and declines to choose between them. Either the bugs were developed through that programme, or the developers used V8CTF framing to talk a model past its safety restrictions. Neither is confirmed.

Operational security is unusually poor for this class of tool. The default payload runs a curl command that downloads an executable into the temp directory and executes it, behaviour most endpoint tooling should catch immediately. That reads like a team optimising to ship before the 3 September Chrome release rather than to stay hidden.

What defenders should do now

Update Chrome and every Chromium-based browser in the estate, and apply the September Windows updates. CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on 4 September with an 18 September remediation deadline for federal civilian agencies.

The Windows privilege escalation only targets older builds, including Windows 10 through 22H2, Server 2019 and 2022, and Windows 11 21H2. Its compilation timestamp dates to 2025, which suggests pre-existing capability packaged into BlueMoon rather than written for this campaign.

Patching closes the door. It does not evict anyone already through it. Check every installed Chromium browser for the GemStone extension, look for scheduled tasks named EdgeCore_AutoUpdate, and hunt for chrome.exe spawning cmd.exe followed by curl.exe. Proofpoint's report carries the full indicator set, including the command table for GemStone.

The wider point Proofpoint makes is the one worth carrying forward. If reverse engineering a public patch into a working browser exploit now takes weeks rather than months, the patch gap stops being a scheduling detail and becomes the attack surface.