Patch-Gap Panic: Chrome V8 Zero-Day Fuels the BlueMoon Espionage Wave
A Chrome V8 out-of-bounds write, chained into the BlueMoon exploit kit, gave state-aligned actors arbitrary code execution from a single click for weeks before the patch shipped.
First Seen: August 6, 2026
Affected Product: Google Chrome
Targeted Industries: Non-governmental organizations, aerospace and defense-industrial firms, mining and physical commodity traders, manufacturing entities, and government and financial-sector entities
Targeted Countries: US, Vietnam, Indonesia, Singapore
Threat Actor: TA412 (aka JungleBamboo, APT31, Violet Typhoon, TIDE CASTLE, Judgment Panda, Zirconium, RedBravo, Bronze Vinewood, Red Keres), UTA0560, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket
Malware: GRIMWEDGE, SUPERSTOMP, LONGTALE (aka GemStone), ShadowPad
Impact: Google has patched CVE-2026-87491, an out-of-bounds write flaw in the V8 JavaScript and WebAssembly engine that powers Google Chrome and other Chromium-based browsers. Google has confirmed the flaw is being actively exploited in the wild, making it the seventh Chrome zero-day of 2026 to see real-world use. A successful attacker gains arbitrary code execution inside the Chrome renderer sandbox with nothing more than a click on a crafted link, and the fix reached the Chromium source tree weeks before the stable Chrome release, creating a patch-gap window that exploit developers moved quickly to weaponise. The vulnerability was patched in Chrome 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and macOS on September 8, 2026.
CVE
| CVE | Name | Affected Product | Zero-Day | CISA KEV | Patch |
|---|---|---|---|---|---|
CVE-2026-87491 | Google Chromium V8 Out of Bounds Write Vulnerability | Google Chrome (V8 Engine) | Yes | Yes | Yes |
Exploitation Timeline
| Date | Event |
|---|---|
| Aug 6, 2026 | Reported to Google |
| Aug 28, 2026 | TA412 begins exploitation |
| Sep 1, 2026 | UTA0560 starts exploitation |
| Sep 2, 2026 | UNK_LateNight, UNK_DoubleCheck start exploitation |
| Sep 3, 2026 | UNK_QuietRacket starts exploitation |
| Sep 8, 2026 | Patch released |
Vulnerability Details
CVE-2026-85046, a type-confusion bug used to obtain arbitrary read/write inside the V8 sandbox) and a Windows kernel local privilege escalation (CVE-2026-85880, abused to escape Chrome’s sandboxed renderer) to achieve full host compromise from a single click. BlueMoon was first observed on August 28, 2026, in the hands of the China-aligned threat actor TA412 (aka JungleBamboo, APT31), and rapidly adopted within days by additional espionage-motivated clusters including UTA0560, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket. Successful exploitation has delivered a mix of post-exploitation payloads including the GRIMWEDGE JScript backdoor, the SUPERSTOMP loader that installs the LONGTALE credential-stealing Chrome extension, the ShadowPad backdoor, and Rust-based loaders, against non-governmental organizations, US aerospace and defense-industrial firms, mining and commodity traders, Vietnamese manufacturing entities, and government/financial-sector targets across Indonesia and Singapore.Vulnerability
| CVE ID | Affected Products | Affected CPE | CWE ID |
|---|---|---|---|
CVE-2026-87491 | Google Chrome versions before 153.0.8010.36 on Windows, macOS, and Linux | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | CWE-787 |
Recommendations
Update every Chrome installation to at least version 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and macOS, then confirm each browser has actually restarted. Do not rely on auto-update alone; use browser or endpoint management tooling to enforce the fixed version. Users of Edge, Brave, Vivaldi, and other Chromium-based browsers should apply their vendor’s next security release as soon as it lands.
Retrospectively investigate high-value endpoints exposed before the September 8 patch. Look for the BlueMoon telltale process tree (chrome.exe spawning cmd.exe, curl.exe, and a dropped msgbox.exe or ChromeUpdate.exe in %TEMP%), sessionStorage keys named v8ctf_exp_attempt, and scheduled tasks such as “Windows Scheduled System” or “EdgeCore_AutoUpdate”.
Enable exploit-protection features in EDR and browser-based memory-integrity controls. Restrict outbound access from browser child processes, block newly registered or low-reputation domains, and watch for Chrome Secure Preferences tampering, since BlueMoon’s post-exploitation loaders silently side-load malicious extensions.
Treat public Chromium source-code changes as a leading indicator of upcoming Chrome vulnerabilities and shorten the internal turnaround for high-severity browser updates. Pair this with tighter controls on legacy Windows builds that remain viable targets for the paired kernel LPE.
The BlueMoon chain reaches victims almost exclusively through spear-phishing links, so continue investing in email filtering, URL rewriting, and user awareness. Enforce phishing-resistant multi-factor authentication and monitor for anomalous session use of authenticated web applications.
Potential MITRE ATT&CK TTPs
Indicators of Compromise (IOCs)
| Type | Value |
|---|---|
| SHA256 (sample) | d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b,337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d,7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c,cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0,b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1,5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6,51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc… 25 total, see original advisory for the full set |
| Domains | cloud[.]shinewrist[.]net,ocr[.]opusaccel[.]top,msbenefit[.]com,gitprogram[.]com,secboxes[.]com,attcdn[.]com,airproducts[.]ink,precipart[.]ink,epsilonsystems[.]net,rocketlabusa[.]ink,spectrolab[.]fit,checrity[.]com,ms[.]checrity[.]com,aurexdefense[.]online,cyclokinetics[.]online,sncorp[.]fit,tcomlp[.]online,bosch-sensortec[.]site,smxtech[.]xyz,lindes[.]ink,silvustechnologies[.]online,worldview[.]fit,emcore[.]ink,airindia[.]fit,airliquide[.]lol,apollohospitals[.]fit,haloengines[.]net,jetoptera[.]co,joinmacket[.]com,openlumakora[.]com,getaiexo[.]com,elixnovorem[.]com,velodynaity[.]com,brianwilli[.]com,fracons[.]com |
| Hostnames | recommendation-letter[.]secboxes[.]com,asianstudies[.]secboxes[.]com,materials-project[.]secboxes[.]com,project[.]secboxes[.]com,evidence[.]msbenefit[.]com,data[.]attcdn[.]com,extension-management-portal[.]centerfjdr658[.]workers[.]dev,wcce[.]joinmacket[.]com,publish[.]openlumakora[.]com,dns[.]elixnovorem[.]com,dns[.]getaiexo[.]com,dns[.]velodynaity[.]com,homepage[.]brianwilli[.]com,1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com |
| IPv4 | 206[.]166[.]251[.]164, 79[.]133[.]56[.]90 |
| Mutex | Dataupcheckinfo |
| Registry Key | HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32 |
Patch Link
References
- chromereleases.googleblog.com — Stable channel update for desktop
- proofpoint.com — Once BlueMoon: multiple state-aligned actors adopt novel exploit
- volexity.com — Mind the patch gap
- hivepro.com — CVE-2026-85046 Chrome V8 type confusion
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)