{"id":"bluemoon-chrome-windows-attacks-aug-2026","category":"patch","status":"live","title":"BlueMoon phishing attacks chained Chrome and Windows zero-days to install espionage malware","tldr":"BlueMoon used phishing links and three Chrome/Windows flaws to install spying malware on targeted Windows PCs. Fixes are available for Chrome, Edge and affected supported Windows versions. Update browsers and Windows; suspected infections need investigation.","summary":"BlueMoon is an exploit kit used in targeted espionage attacks first observed by Proofpoint on 28 August. Phishing links led to pages that combined two Chrome V8 flaws with a Windows privilege-escalation flaw to install malware on older Windows systems. Initial targets included people at US NGOs, mining companies and commodity trading firms; Proofpoint subsequently identified four clusters using the kit. Volexity independently documented NGO targeting, including emails sent to personal and work addresses. Payloads included backdoors and a fake Google Gemini extension that stole credentials and browser sessions. The Chrome flaws had fixes in public Chromium source code before those fixes reached stable Chrome releases. Released fixes are confirmed for Chrome, Edge and Microsoft's listed affected Windows branches; this does not establish fix coverage for every other Chromium browser. Microsoft's Windows record was updated on 31 October. Sources reviewed through 3 November do not establish victim totals or that the campaigns have ended.","action":"Update Chrome through Help → About Google Chrome, or Edge through Help and feedback → About Microsoft Edge, then relaunch; Chrome 153.0.8010.36 and Edge 152.0.4191.66 are the minimum versions covering both browser flaws. Install all available Windows security updates, and ask IT to replace unsupported Windows versions. If you opened a suspicious link or find an unfamiliar Gemini extension, ask IT or a trusted security specialist to investigate: updating does not remove an existing infection.","product":"Google Chrome and Microsoft Edge on Microsoft Windows","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-85046","CVE-2026-87491","CVE-2026-85880"],"tags":["google","chrome","microsoft","windows","zero-day","phishing","espionage","bluemoon"],"affected":["Google Chrome before 152.0.7977.82: CVE-2026-85046","Google Chrome before 153.0.8010.36: CVE-2026-87491","Microsoft Edge before 152.0.4191.62: CVE-2026-85046; before 152.0.4191.66: CVE-2026-87491","Windows 10: 1607 before 10.0.14393.9512; 1809 before 10.0.17763.9245; 21H2 before 10.0.19044.7725; 22H2 before 10.0.19045.7725","Windows Server 2012, including Core: before 6.2.9200.26349","Windows Server 2012 R2, including Core: before 6.3.9600.23398","Windows Server 2016, including Core: before 10.0.14393.9512","Windows Server 2019, including Core: before 10.0.17763.9245","Windows Server 2022: before 10.0.20348.5622"],"fixed":["Chrome 152.0.7977.82/.83 Windows/macOS; 152.0.7977.82 Linux: CVE-2026-85046","Chrome 153.0.8010.36/.37 Windows/macOS; 153.0.8010.36 Linux: CVE-2026-87491","Edge 152.0.4191.62: CVE-2026-85046; 152.0.4191.66: CVE-2026-87491","Windows 10 1607 / Server 2016: 10.0.14393.9512","Windows 10 1809 / Server 2019: 10.0.17763.9245","Windows 10 21H2: 10.0.19044.7725","Windows 10 22H2: 10.0.19045.7725","Windows Server 2012: 6.2.9200.26349","Windows Server 2012 R2: 6.3.9600.23398","Windows Server 2022: 10.0.20348.5622"],"matches":[{"platform":"windows","app":"Google Chrome","bundle":"","fixed":"153.0.8010.36"},{"platform":"macos","app":"Google Chrome","bundle":"com.google.Chrome","fixed":"153.0.8010.36"},{"platform":"linux","app":"Google Chrome","bundle":"","fixed":"153.0.8010.36"},{"platform":"windows","app":"Microsoft Edge","bundle":"","fixed":"152.0.4191.66"},{"platform":"macos","app":"Microsoft Edge","bundle":"com.microsoft.edgemac","fixed":"152.0.4191.66"},{"platform":"linux","app":"Microsoft Edge","bundle":"","fixed":"152.0.4191.66"},{"platform":"windows","app":"Windows 10 Version 1607","bundle":"","fixed":"10.0.14393.9512"},{"platform":"windows","app":"Windows 10 Version 1809","bundle":"","fixed":"10.0.17763.9245"},{"platform":"windows","app":"Windows 10 Version 21H2","bundle":"","fixed":"10.0.19044.7725"},{"platform":"windows","app":"Windows 10 Version 22H2","bundle":"","fixed":"10.0.19045.7725"}],"sources":[{"kind":"advisory","title":"Stable Channel Update for Desktop — Chrome 152","url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html?hl=de","by":"Google","date":"2026-09-03"},{"kind":"advisory","title":"Stable Channel Update for Desktop — Chrome 153","url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html?m=1","by":"Google","date":"2026-09-08"},{"kind":"advisory","title":"Microsoft-authored CVE-2026-85880 record, updated 31 October","url":"https://cveawg.mitre.org/api/cve/CVE-2026-85880","by":"Microsoft","date":"2026-10-31"},{"kind":"advisory","title":"Release notes for Microsoft Edge Security Updates","url":"https://learn.microsoft.com/en-ca/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","date":"2026-09-04"},{"kind":"advisory","title":"CVE-2026-87491: Google description and CISA exploitation assessment","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json","by":"Google and CISA","date":"2026-09-21"},{"kind":"research","title":"Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days","url":"https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit","by":"Proofpoint","date":"2026-09-09"},{"kind":"research","title":"Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows","url":"https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/","by":"Volexity","date":"2026-09-09"},{"kind":"news","title":"New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws","url":"https://www.bleepingcomputer.com/news/security/new-bluemoon-kit-exploited-windows-and-chrome-zero-day-flaws/amp/","by":"BleepingComputer","date":"2026-09-10"}],"started":"2026-08-28","closed":null,"created":"2026-11-03T21:07:14.116Z","updated":"2026-11-03T21:07:14.116Z","cve_notes":[{"cve":"CVE-2026-85046","name":"Type confusion in Chrome's V8 engine","what":"A type-confusion flaw in Chrome's V8 JavaScript engine lets a malicious web page run attacker-controlled code inside the browser sandbox.","severity":"high","cvss":8.8},{"cve":"CVE-2026-87491","name":"Out-of-bounds write in Chrome's V8 engine","what":"An out-of-bounds write in Chrome's V8 engine lets a malicious web page run code inside the browser sandbox; BlueMoon used it to escape V8's internal sandbox.","severity":"medium","cvss":8.8},{"cve":"CVE-2026-85880","name":"Privilege escalation in Windows ALPC","what":"A heap buffer overflow in Windows Advanced Local Procedure Call lets an attacker with existing local access gain elevated privileges.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-31","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"Microsoft updated its Windows CVE record. The current record lists fixed builds for affected Windows 10 and Windows Server branches.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-85880","by":"Microsoft","patch":null},{"at":"2026-09-09","added":"2026-11-03T20:51:54.186Z","kind":"cisa-added","text":"CISA added CVE-2026-87491 to its catalogue of vulnerabilities known to be exploited.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json","by":"Google and CISA","patch":null},{"at":"2026-09-09","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Proofpoint publicly described BlueMoon and four espionage clusters using it. One campaign installed GemStone, a malicious browser extension impersonating Google Gemini that stole credentials and monitored browsing.","url":"https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit","by":"Proofpoint","patch":null},{"at":"2026-09-08","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Microsoft published CVE-2026-85880 and Windows security fixes. CISA added the Windows flaw to its exploited-vulnerability catalogue that day.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-85880","by":"Microsoft and CISA","patch":"patched"},{"at":"2026-09-08","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Google released Chrome 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, fixing CVE-2026-87491. Google confirmed this flaw was also being exploited.","url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html?m=1","by":"Google","patch":"partial"},{"at":"2026-09-04","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Microsoft released Edge 152.0.4191.66 with a fix for CVE-2026-87491. Its 2 September release, 152.0.4191.62, had fixed CVE-2026-85046.","url":"https://learn.microsoft.com/en-ca/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","patch":"partial"},{"at":"2026-09-03","added":"2026-11-03T20:51:54.186Z","kind":"new-fix","text":"Google released Chrome 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, fixing CVE-2026-85046. Google confirmed exploitation.","url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html?hl=de","by":"Google","patch":"partial"},{"at":"2026-08-28","added":"2026-11-03T20:51:54.186Z","kind":"wider-attacks","text":"Proofpoint first observed TA412 using BlueMoon against people at US NGOs, mining companies and commodity trading firms. Phishing links delivered malware through Chrome and Windows flaws.","url":"https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit","by":"Proofpoint","patch":"partial"}],"url":"https://hard.fyi/live/bluemoon-chrome-windows-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=bluemoon-chrome-windows-attacks-aug-2026"}