Reported by 25 outlets

Timeline

1. original reporting

   Proofpoint identified BlueMoon, an exploit kit chaining two Chrome/V8 flaws with a Windows privilege escalation. In use since August 28 by f

   cyberworldops.eu · 34d ago · September 9th, 2026

   Proofpoint identified BlueMoon, an exploit kit chaining two Chrome/V8 flaws with a Windows privilege escalation. In use since August 28 by f

   via Mastodon https://cyberworldops.eu/en/bluemoon-exploit-kit-gives-four-espionage-groups-a-shared-chrome-to

2. update from chromereleases.googleblog.com

   Stable Channel Update for Desktop

   chromereleases.googleblog.com · 41d ago · September 3rd, 2026

   Google shipped Chrome stable 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux on September 3, 2026, fixing High CVE-2026-85046, a V8 type confusion reported by Salvatore Gulizia (Serotav) on 2026-08-04. The advisory states Google was aware that an exploit for CVE-2026-85046 existed in the wild.

3. update from www.cisa.gov

   CISA adds CVE-2026-85046 (Google Chromium V8) to the Known Exploited Vulnerabilities catalog

   www.cisa.gov · 40d ago · September 4th, 2026

   CISA's KEV feed lists CVE-2026-85046, a Google Chromium V8 type confusion, with dateAdded 2026-09-04 and a federal remediation due date of 2026-09-18. The entry cites Google's September 3 stable channel advisory. This placed the first of the two V8 flaws in the catalog five days before the chained attacks became public.

4. update from www.cisa.gov

   CISA adds CVE-2026-85880 (Microsoft Windows) to the Known Exploited Vulnerabilities catalog

   www.cisa.gov · 36d ago · September 8th, 2026

   The entry links Microsoft's update guide page for the CVE. CISA catalogued it as exploited the same day Microsoft shipped the fix.

5. update from msrc.microsoft.com

   September 2026 Security Updates (CVE-2026-85880, Windows ALPC Elevation of Privilege)

   msrc.microsoft.com · 35d ago · September 8th, 2026

   Microsoft's September 2026 Patch Tuesday advisory disclosed CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call that allows an authorized attacker to elevate privileges locally. Remediations include the September cumulatives KB5122876, KB5122882, and KB5122878. A 2026-09-16 revision corrected the temporal Exploit Code Maturity setting in the CVSS vector, an informational change pointing at maturing exploit code.

6. update from serotav.github.io

   When Sorting Leads To Confusion (CVE-2026-85046 write-up)

   serotav.github.io · 35d ago · September 8th, 2026

   The original researcher disclosure by Serotav (Salvatore Gulizia), dated by the commit that published it on his GitHub on 2026-09-08. It details the V8 Maglev/TurboFan type confusion in the inlined Array.prototype.sort, where a comparator calling Array.fill() flips elements kind mid-sort to gain addrof and arbitrary read/write on the JS heap, chained with an n-day sandbox escape for his v8CTF submission.

7. update from chromereleases.googleblog.com

   Stable Channel Update for Desktop (Chrome 153.0.8010.36/.37)

   chromereleases.googleblog.com · 35d ago · September 8th, 2026

   Google promoted Chrome 153 to stable with 230 security fixes, including CVE-2026-87491, an out-of-bounds write in V8 reported on 2026-08-06, rated Medium and rewarded $3,000.

8. update from volexity.com

   Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

   volexity.com · 35d ago · September 9th, 2026

   Volexity's original disclosure documents UTA0560 and JungleBamboo (APT31/Violet Typhoon/TA412) using the identical Chrome and Windows zero-day chain from September 1, 2026, delivering GRIMWEDGE and SUPERSTOMP/LONGTALE respectively. It reports CVE-2026-85046 was reported to Chromium on August 4, 2026 and fixed in Chromium source before any Chrome release, creating a patch-gap zero-day, and that the CVE-2026-85880 kernel exploit in RtlpCreateServerAcl only targets Windows builds 17763 through 22000.

9. update from proofpoint.com

   Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days

   proofpoint.com · 35d ago · September 9th, 2026

   Proofpoint names the shared kit BlueMoon and identifies four espionage-motivated users: TA412 from August 28, 2026, UNK_LateNight and UNK_DoubleCheck from September 2, and UNK_QuietRacket from September 3, delivering GemStone, ShadowPad, a Rust loader, and custom .NET malware. The report dates the CVE-2026-85046 fix commit to August 7, 2026 and its arrival in stable Chromium to September 3, 2026, a nearly four-week patch gap, and publishes ET rules 2071919-2071924 and 2071996-2072001 plus a YARA rule for the kit.

10. mentioned by thehackernews.com

    Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

    thehackernews.com · 35d ago · September 9th, 2026

11. update from www.volexity.com

    Earlier this month, @ volexity detected multiple Chinese threat actors launching attacks against its customers using chained 0-day exploits

    www.volexity.com · 34d ago · September 9th, 2026

    Earlier this month, @ volexity detected multiple Chinese threat actors launching attacks against its customers using chained 0-day exploits

    via Mastodon https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/

12. mentioned by arstechnica.com

    4 groups caught using the same Chrome and Windows exploit kit https://arstechnica.com/information-technology/2026/09/4-groups-caught-using-t

    arstechnica.com · 34d ago · September 9th, 2026

13. update from cyberscoop.com

    Chinese espionage groups swarm to exploit triple-link chain of zero-days

    cyberscoop.com · 34d ago · September 9th, 2026

    Proofpoint researchers have spotted at least four state-aligned threat groups chain a trio of zero-day vulnerabilities to conduct espionage on various targets of interest to China’s government since late August. The Chinese espionage group that Proofpoint tracks as TA412, also known as Violet Typhoon and APT31, struck first, exploiting the chain of vulnerabilities Aug. At least three additional espionage threat groups followed suit, exploiting the same vulnerabilities in subsequent waves of attacks days later, researchers said. It allows attackers to run code in the browser’s sandbox, escape the sandbox and gain system privileges to access a targeted machine, said Mark Kelly, staff threat researcher at Proofpoint. “All three vulnerabilities were exploited before patches were available to the public,” he said. “While the V8 vulnerabilities were known and fixed in Chromium source code, they were not yet patched in the latest publicly available browsers at the time of the activity, meaning they effectively functioned as zero-days in those products,” Kelly said.

14. mentioned by arstechnica.com

    4 groups caught using the same Chrome and Windows exploit kit

    arstechnica.com · 34d ago · September 9th, 2026

15. update from threatnoir.com

    ⚠️ CRITICAL: N-able N-central Pre-Auth RCE Flaw Exploited in the Wild CVE-2026-86218 is a critical pre-auth RCE in N-able N-central being ac

    threatnoir.com · 34d ago · September 10th, 2026

    ⚠️ CRITICAL: N-able N-central Pre-Auth RCE Flaw Exploited in the Wild CVE-2026-86218 is a critical pre-auth RCE in N-able N-central being ac

    via Mastodon https://threatnoir.com/focus

16. mentioned by threatnoir.com

    ⚠️ CRITICAL: Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox Google patched CVE-2026-87491, a zero-day out-of

    threatnoir.com · 34d ago · September 10th, 2026

17. update from www.yazoul.net

    🟠 New security advisory: CVE-2026-87491 affects Google Chrome. • Impact: Significant security breach potential • Risk: Unauthorized access o

    www.yazoul.net · 34d ago · September 10th, 2026

    • Impact: Significant security breach potential • Risk: Unauthorized access o

    via Mastodon https://www.yazoul.net/advisory/cve/cve-2026-87491-chrome-v8-rce-exploited-in-the-wild

18. update from cyberwald.com

    Cyberwald Cybersecurity News Podcast - September 10, 2026: Chrome Zero-Day CVE-2026-87491 in V8 Engine, Microsoft Defender Shield Bypass

    cyberwald.com · 33d ago · September 10th, 2026

    🎙️ Cyberwald - Cybersecurity-News - 10.09.2026 Heute im Podcast: • Chrome-Zero-Day CVE-2026-87491 in der V8-Engine • Microsoft Defender Shie

    via Mastodon https://cyberwald.com/podcast/2026-09-10.podcast.ogg

19. mentioned by cybertop.ai

    CYBERTOP AI analyzed CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability actively exploited in the wild. Harden defenses: r

    cybertop.ai · 33d ago · September 10th, 2026

20. update from deafnews.it

    Google patches seventh Chrome zero-day of 2026. CVE-2026-87491 in V8 engine actively exploited, CISA sets September 23 deadline for federal

    deafnews.it · 33d ago · September 10th, 2026

    CVE-2026-87491 in V8 engine actively exploited, CISA sets September 23 deadline for federal

    via Mastodon https://deafnews.it/en/article/chromes-seventh-2026-zero-day-cisa-mandates-patch-by-september-23

21. update from bleepingcomputer.com

    'BlueMoon' kit exploited Windows and Chrome zero-day flaws

    bleepingcomputer.com · 33d ago · September 10th, 2026

    The kit appears to be a shared modular tool that supports exploit additions and was used in distinct operations. Researchers at enterprise cybersecurity company Proofpoint observed BlueMoon being used since August 28 in spearphishing operations attributed to the JungleBamboo (a.k.a. APT31, Violet Typhoon, APT31, Tide Castle) threat actor associated with China. Cybersecurity and threat intelligence company Volexity also observed similar activity on September 1st, in campaigns from another actor it tracks as UTA0560 that targeted "customers at multiple non-governmental organizations (NGOs)." According to the researchers, the BlueMoon developer maintainers take advantage of the delay between public Chromium fixes and stable Chrome releases, reverse-engineer public code changes, and create exploits to target downstream browser users.

22. mentioned by www.bleepingcomputer.com

    New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws https:// bleepingcomputer.com/news/security/ new-bluemoon-kit-exploited-windo

    www.bleepingcomputer.com · 33d ago · September 10th, 2026

23. update from www.it-connect.fr

    BlueMoon exploit kit chains Chrome V8 flaws with Windows privilege escalation to compromise fully patched systems

    www.it-connect.fr · 32d ago · September 11th, 2026

    [VULN] BlueMoon: fully patched PCs compromised via Google Chrome and Windows vulnerabilities. The BlueMoon attack (named by Proofpoint) chains Google Chrome and Windows vulnerabilities to compromise fully patched systems.

24. update from cyberpress.org

    Chinese Hackers Chain Chrome and Windows Zero-Days to Deploy Backdoors and Steal Credentials

    cyberpress.org · 31d ago · September 12th, 2026

    The campaign abused Chrome vulnerability CVE-2026-85046 , a type-confusion flaw in the V8 JavaScript engine. Chinese Hackers Chain Chrome and Windows Zero-Days Although a fix had entered the open-source Chromium codebase, it was not yet available in a released Chrome update during the attacks. This created a patch-gap condition: technically an N-day in Chromium source, but an effective zero-day for Chrome users. Victims received phishing emails containing links to legitimate websites vulnerable to reflected cross-site scripting (XSS) . The attackers used the XSS flaw to redirect recipients to attacker-controlled infrastructure hosting the exploit framework. phishing email (Source: volexity) The landing page displayed a convincing donation-form image tailored to the victim organization while a hidden iframe launched the exploit in the background.

25. update from gbhackers.com

    China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks

    gbhackers.com · 31d ago · September 12th, 2026

    Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome […] The post China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

26. update from www.dztecs.com

    🚀 عدة مجموعات قرصنة تستخدم نفس برمجية Chrome الخبيثة خلال أسبوع: ما الدلالة؟ اكتشف لماذا تستخدم مجموعات قرصنة متعددة برامج Chrome الضارة نفس

    www.dztecs.com · 31d ago · September 12th, 2026

    🚀 عدة مجموعات قرصنة تستخدم نفس برمجية Chrome الخبيثة خلال أسبوع: ما الدلالة؟ اكتشف لماذا تستخدم مجموعات قرصنة متعددة برامج Chrome الضارة نفس

    via Mastodon https://www.dztecs.com/tech/multiple-hacking-groups-found-using-the-same-chrome-malware-in-the-same-week-so-what-does-it-mean/

27. mentioned by cyberscoop.com

    APT31 Uses BlueMoon to Target US Organizations https:// cyberscoop.com/china-espionag e-groups-exploit-chain-zero-days/ … China-aligned espi

    cyberscoop.com · 31d ago · September 12th, 2026

28. update from cybersecurefox.com

    ShieldCrash: Claimed Bypass of CVE-2026-69414 Patch in Microsoft Defender 🔗 https:// cybersecurefox.com/en/shieldcr ash-bypass-patch-cve-202

    cybersecurefox.com · 30d ago · September 13th, 2026

    ShieldCrash: Claimed Bypass of CVE-2026-69414 Patch in Microsoft Defender 🔗 https:// cybersecurefox.com/en/shieldcr ash-bypass-patch-cve-202

    via Mastodon https://cybersecurefox.com/en/shieldcrash-bypass-patch-cve-2026-69414-microsoft-defender

29. mentioned by threatnoir.com

    ⚠️ CRITICAL: BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days BlueMoon exploit kit chains unpatched Chrome and Windows zero-days

    threatnoir.com · 30d ago · September 14th, 2026

30. update from rapid7.com

    CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

    rapid7.com · 29d ago · September 14th, 2026

    Overview On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706 , a critical path traversal vulnerability ( CWE-22 ) in the repository commits API with a CVSSv3.1 score of 10.0 . According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions. CISA set a remediation due date of September 14, 2026, for affected Federal Civilian Executive Branch agencies and marked the vulnerability as subject to forensic triage requirements under Binding Operational Directive 26-04. Organizations running affected self-managed GitLab instances should remediate CVE-2026-85706 on an emergency basis, outside of normal patch cycles. Mitigation guidance A vendor-supplied update is available to remediate CVE-2026-85706. Affected GitLab CE/EE versions Fixed version All versions from 18.7 before 19.1.8 19.1.8 All versions from 19.2 before 19.2.6 19.2.6 All versions from 19.3 before 19.3.2 19.3.2 GitLab.com is already running a patched versio

31. mentioned by cybersecurefox.com

    CVE-2026-85880: exploited Windows ALPC heap overflow vulnerability 🔗 https:// cybersecurefox.com/en/cve-2026 -85880-windows-alpc-heap-overfl

    cybersecurefox.com · 29d ago · September 14th, 2026

32. mentioned by thehackernews.com

    China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

    thehackernews.com · 29d ago · September 15th, 2026

33. update from cyberwald.com

    Cyberwald Cybersecurity News: Microsoft Emergency RDS Patches and CVE-2026-85706 GitLab Flaw

    cyberwald.com · 28d ago · September 15th, 2026

    Today's episode covers: Microsoft emergency updates following RDS outages caused by September patches, GitHub vulnerability details, and CVE-2026-85706 maximum severity GitLab flaw affecting supply chains.

34. update from www.darkreading.com

    🖲️ # Cybersecurity # Ciberseguridad # Ciberseguranca # Security # Seguridad # Seguranca # News # Noticia # Noticias # Tecnologia # Technolog

    www.darkreading.com · 28d ago · September 15th, 2026

    🖲️ # Cybersecurity # Ciberseguridad # Ciberseguranca # Security # Seguridad # Seguranca # News # Noticia # Noticias # Tecnologia # Technolog

    via Mastodon https://www.darkreading.com/cyberattacks-data-breaches/maximum-severity-gitlab-flaw-supply-chains-risk

35. update from www.darkreading.com

    CISA changes vulnerability reporting approach, drops weekly roundups in favor of risk-based focus

    www.darkreading.com · 25d ago · September 18th, 2026

    📡 CISA changes vulnerability reporting approach, drops weekly roundups in favor of risk-based focus

    via Mastodon https://www.darkreading.com/cyber-risk/cisa-ditches-weekly-vuln-roundups-risk-based-focus

36. update from volexity.com

    Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

    volexity.com · 23d ago · September 21st, 2026

    Volexity's follow-up discloses UTA0565, a third Chinese actor, using the same chain on September 3-4, 2026 from typosquats including chinadigitaltimes[.]top and americanprgoress[.]top, the latter loading a hidden iframe to /config.html that serves the exploit kit. The campaign delivered the previously undocumented CLEANGULP backdoor as chrome_cleanup.exe (SHA-256 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb), installing to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe with a scheduled task named MicrosoftIME and C2 at thecovnresation[.]com.

37. mentioned by www.volexity.com

    Following @ volexity ’s September 9 blog post on two Chinese APT actors chaining 0-days in Chrome (CVE-2026-85046, CVE-2026-87491) & Windows

    www.volexity.com · 22d ago · September 21st, 2026

38. update from arstechnica.com

    Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day

    arstechnica.com · 22d ago · September 22nd, 2026

    submitted by /u/favorscore [link] [comments]

    via reddit r/cybersecurity: Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day

39. mentioned by arstechnica.com

    Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day https:// arstechnica.com/security/2026/ 09/muse-metas-extraordinar

    arstechnica.com · 22d ago · September 22nd, 2026

40. update from threatnoir.com

    ⚠️ CRITICAL: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO PAYLOAD ransomware group is exploiting domain admin a

    threatnoir.com · 22d ago · September 22nd, 2026

    ⚠️ CRITICAL: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO PAYLOAD ransomware group is exploiting domain admin a

    via Mastodon https://threatnoir.com/focus

41. update from threatnoir.com

    ⚠️ CRITICAL: Malicious npm packages evade install-script defenses at runtime Threat actors are distributing malware via npm packages that by

    threatnoir.com · 22d ago · September 22nd, 2026

    ⚠️ CRITICAL: Malicious npm packages evade install-script defenses at runtime Threat actors are distributing malware via npm packages that by

    via Mastodon https://threatnoir.com/focus

42. update from cyberpress.org

    Chinese Hackers Use Fake Websites to Exploit Chrome and Windows Zero-Days

    cyberpress.org · 21d ago · September 22nd, 2026

    One Chinese-language email urged recipients to support jailed Hong Kong activist Chow Hang-tung and oppose suppression of June 4 remembrance activities. Another campaign impersonated the Center for American Progress. Examples included chinadigitaltimes[.]top, impersonating China Digital Times, and americanprgoress[.]top, impersonating americanprogress[.]org. The fake American

43. mentioned by gbhackers.com

    Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits

    gbhackers.com · 21d ago · September 22nd, 2026

44. mentioned by gbhackers.com

    A Chinese APT cloned legitimate websites to serve Chrome and Windows zero-day exploits

    gbhackers.com · 21d ago · September 22nd, 2026

45. mentioned by thehackernews.com

    🤖 Chinese threat actor UTA0565 chained three zero-days — Chrome (CVE-2026-85046, CVE-2026-87491) and Windows ALPC (CVE-2026-85880) — via fak

    thehackernews.com · 20d ago · September 23rd, 2026

46. update from bleepingcomputer.com

    InfraTrust report warns network management systems under attack

    bleepingcomputer.com · 20d ago · September 23rd, 2026

    Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. This was reported in the September edition of Eclypsium's InfraTrust Pulse , a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure. Between August 25 and September 17, InfraTrust tracked 158 new security advisories across 17 vendors, covering 1,699 vulnerabilities. However, InfraTrust says one of the more significant trends this month is where many of the most dangerous vulnerabilities are appearing. "This is the second consecutive month the highest-value exploited flaws in infrastructure were in administrative software, so treat these platforms as high-value targets and patch, monitor, and harden them accordingly," reads the report.

47. mentioned by thehackernews.com

    🚨🐛 SIGINT // Cybersecurity Watch — 2026-09-26 State-linked actors chaining a Chrome-Windows zero-day exploit to drop CLEANGULP malware highl

    thehackernews.com · 18d ago · September 25th, 2026

48. update from malware.news

    How BlueMoon Exploits Chrome CVE-2026-85046 and CVE-2026-87491

    malware.news · 5d ago · October 8th, 2026

    Key Takeaways BlueMoon Exploit Kit, first observed on August 28, 2026, turns visits to malicious websites into Windows malware execution. Spearphishing emails lead victims to attacker-controlled exploit pages, some of which then redirect to legitimate websites. The Picus Threat Library includes BlueMoon-related threats for testing defenses against V8 exploits and GemStone malware. Campaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].

49. mentioned by www.picussecurity.com

    (picussecurity.com) Analysis of BlueMoon Exploit Kit: Chaining V8 and Windows Kernel Exploits for Malware Delivery In brief - This article d

    www.picussecurity.com · 5d ago · October 8th, 2026

50. mentioned by www.picussecurity.com

    New. Picus: How BlueMoon Exploits Chrome CVE-2026-85046 and CVE-2026-87491 https://www. picussecurity.com/resource/blo g/how-bluemoon-exploi

    www.picussecurity.com · 5d ago · October 8th, 2026

51. update from www.proofpoint.com

    Monitor Proofpoint's research for CVE identifiers as they emerge and patch Chrome and Windows the moment advisories drop — or accept the deb

    www.proofpoint.com · 3d ago · October 10th, 2026

    Monitor Proofpoint's research for CVE identifiers as they emerge and patch Chrome and Windows the moment advisories drop — or accept the deb

    via Mastodon https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit