Security researchers have identified a new BlueMoon exploit kit that chains two Chrome vulnerabilities with a Windows privilege escalation flaw. Proofpoint first observed China-aligned group APT31 using it on August 28, 2026. Three more espionage clusters adopted it within days.<\/p>\n
The rapid reuse matters because a fully weaponized Chrome exploit chain has historically been rare and costly to build. Proofpoint noted the kit moved from single-actor to multi-actor use within about a week, despite high detection signals. That speed suggests shared tooling access or a lower barrier to building this capability.<\/p>\n
For enterprise defenders, the chain turns one clicked link into full code execution and elevated privileges. It bypasses browser sandboxing<\/a> and reaches Windows kernel-adjacent territory, raising the stakes beyond a typical browser bug.<\/p>\n