Four Unpatched Flaws, One Click: How the BlueMoon Exploit Kit Turns Chrome Into a Full System Takeover
A newly identified hacking toolkit chains together browser and Windows vulnerabilities to hand attackers full control of a victim's computer the moment they click a link. Several groups, most with suspected ties to China, were sharing the kit within days of its first use.
Key points
- Proofpoint researchers, working with Google and Microsoft, identified a hacking toolkit called BlueMoon that chains four separate security flaws to take over a Windows computer in a single click.
- The toolkit exploits two "patch-gap" vulnerabilities in Google Chrome, meaning fixes existed in the underlying code but had not yet reached users' installed browsers.
- A campaign beginning August 28 targeted NGOs, mining companies, and commodity trading firms in the US using fake student emails and conference invitations.
- Within days of that first campaign, at least three other espionage-focused hacking groups adopted the same toolkit, the majority suspected to have a China nexus.
- Patching Chrome and Windows immediately is the primary fix, but anything the kit already installed must be removed separately.
A hacking toolkit called BlueMoon can give criminals full administrative control over a Windows computer the moment someone clicks a link in a phishing email. Researchers at Proofpoint, working alongside Google's threat intelligence team, Microsoft, and cybersecurity firm Volexity, published findings this week on how the kit works and who has been using it.
How does BlueMoon actually work?
BlueMoon chains four separate security flaws together. A victim clicks a link, and within seconds the attackers own the machine.
The first two flaws sit inside Chrome's V8 JavaScript engine, the part of the browser that runs interactive code on web pages. CVE-2026-85046 is a "type confusion" flaw, a bug where the software misreads what kind of data it is handling, which lets attackers slip malicious instructions into the browser's memory. CVE-2026-87491 then breaks out of Chrome's sandbox, the protective wall the browser uses to stop rogue code from reaching the rest of the computer. Together, those two flaws let attackers run any software they choose inside Chrome.
A third flaw, CVE-2026-85880, is a Windows kernel privilege escalation bug, meaning it tricks Windows into granting the attacker full administrator rights. That applies to Windows 10 version 22H2 and Windows 11 version 21H2. At that point, the attackers can install anything: spyware, password stealers, remote access tools.
| Flaw | Affected software | What it does |
|---|---|---|
| CVE-2026-85046 | Chrome / Chromium (V8) | Lets attackers place malicious code in browser memory |
| CVE-2026-87491 | Chrome / Chromium (V8) | Breaks out of Chrome's protective sandbox |
| CVE-2026-85880 | Windows 10 22H2, Windows 11 21H2 | Grants attacker full admin rights on the machine |
What is a "patch gap" and why does it matter?
This is the sharp edge of the BlueMoon story. Chrome is built on open-source code called Chromium. When a researcher reported CVE-2026-85046 to the Chromium project on August 4, a fix was added to that public code base. But the fix had not yet been packaged into the version of Chrome that people actually download and run.
That gap, sometimes days or weeks wide, is where BlueMoon lived. For Chrome users, the flaw was effectively unknown and unpatched, even though the underlying fix existed somewhere online. Proofpoint notes that AI tools are letting criminals reverse-engineer exploits from public code much faster than before, shrinking the time defenders have to react.
Should ordinary people and organisations be worried?
Yes, but there are concrete steps to take right now.
The first campaign, which began August 28 and was tracked as targeting a small number of NGOs, mining firms, and commodity traders in the US, used carefully crafted emails: fake internship inquiries, conference invitations, even personalised back-and-forth conversations to build trust before sending a malicious link. That kind of targeted approach, known as spear phishing, is designed to fool even careful readers.
Within days, several other espionage-focused hacking groups adopted the same toolkit. Proofpoint assessed, at medium confidence, that the majority have a suspected China nexus. The research team also warned the kit will likely spread to financially motivated criminal groups.
If you or your organisation clicked a suspicious link in this period, patching Chrome and Windows removes the vulnerability going forward. It does not remove anything BlueMoon may have already installed. Organisations should scan for leftover artefacts such as unexpected Chrome extensions, scheduled tasks, or unusual registry entries (configuration settings stored in Windows). Proofpoint has published detection rules to assist security teams with that search.
For employees: be sceptical of unexpected emails asking you to click a link, even when the sender seems familiar or the request feels plausible. One click is all this particular kit needs.
