BlueMoon reportedly chains Chrome and Windows zero-days

From browser compromise to Windows privilege escalation

The report says multiple cyber-espionage groups used BlueMoon, an exploit kit that links three vulnerabilities: two in Chromium-based browsers and one in Windows. Proofpoint reportedly observed its use from August 28 in spearphishing activity attributed to JungleBamboo, while Volexity described similar activity on September 1 involving UTA0560 and NGO customers. The report also says the Windows flaw, CVE-2026-85880, may have been used since 2025 before being repackaged in BlueMoon.

The reported flaws affected Chromium-based browsers and Windows as separate security issues.

The BlueMoon kit reportedly chains two Chromium-browser flaws with a Windows privilege-escalation flaw into a modular exploitation tool used in distinct operations.

The reported activity would connect browser exploitation and Windows privilege escalation in one reusable toolkit, with four activity clusters identified across the two researchers' accounts.