What happened
On August 28, Proofpoint observed China-linked TA412 using a previously undocumented browser exploit kit called BlueMoon. Within a week, at least three additional state-aligned espionage clusters had adopted the same chain against targets in the United States and Southeast Asia. TA412 is also tracked as Violet Typhoon, APT31, and JungleBamboo.
How the exploit chain works
BlueMoon chains three vulnerabilities into a one-click compromise. CVE-2026-85046 is a type-confusion flaw in Chrome's V8 JavaScript engine that provides arbitrary memory access inside the V8 sandbox. CVE-2026-87491 is a V8 sandbox escape via WebAssembly metadata corruption that allows shellcode execution. CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC (Advanced Local Procedure Call) that elevates privileges to SYSTEM. A single click on a malicious link takes an attacker from browser compromise to full operating system control, with no additional user interaction required.
Four groups, one kit
The rapid multi-actor adoption is the detail that stands out. Sophisticated browser exploit chains are historically closely held. Seeing four separate espionage groups use the same underlying code within a week suggests either a shared broker, shared infrastructure, or a leak. Proofpoint's advisory tracks the adoption timeline but does not attribute the kit's origin or explain how the groups obtained it. That ambiguity is itself a finding worth watching.
Patch now
Chrome patches for CVE-2026-85046 and CVE-2026-87491 shipped in the stable channel on September 3 and September 8. The Windows ALPC flaw (CVE-2026-85880) was fixed in the September 2026 Patch Tuesday release and added to CISA's Known Exploited Vulnerabilities catalog with an FCEB deadline of September 22. Update Chrome first, then apply September Patch Tuesday. If you need to hunt for prior compromise, review Proofpoint's IOC package published alongside the "Once in a BlueMoon" advisory.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss threat actor tooling or nation-state exploit chain analysis.