Three distinct vulnerabilities — CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 — were chained in a single exploit sequence that allowed attackers to escape Chrome’s V8 sandbox, escalate privileges, and achieve arbitrary code execution on Windows hosts.
How the BlueMoon chain was used in a targeted spear-phish
Security firm Volexity, tracking the cluster as UTA0560, says the actor sent spear-phishing emails on September 1, 2026, to multiple non-governmental organizations (NGOs). The messages "encourag[ed] the users to click a link that led to the website of a U.S.-based university," and those links abused a reflected cross-site scripting (XSS) flaw on the site to redirect victims to attacker-controlled infrastructure.
Once the victim arrived, the site triggered what Proofpoint and Volexity have called the BlueMoon exploit chain. Volexity described the three-step technical sequence: CVE-2026-85046 was used to obtain arbitrary read/write inside the V8 sandbox, CVE-2026-87491 was used to escape the browser sandbox, and CVE-2026-85880 targeted Windows ALPC to inject code into the Chrome process and realize arbitrary code execution.
Payload staging: three embedded binaries and a sideloading loader
Volexity observed the final exploit page embedding three Base64-encoded binary payloads within JavaScript: "p1," shellcode that reflectively loads a DLL for host reconnaissance and fingerprinting; "p2," shellcode that reflectively loads a DLL to facilitate kernel privilege escalation; and "pp," shellcode to perform browser process injection and payload download. The exploit filtered out systems not running Chrome on Windows before delivering these payloads.
In the UTA0560 activity, the next-stage payload was an executable named "msgbox.exe." Volexity reported msgbox.exe acting as a loader that extracts a legitimate Windows binary and a malicious DLL named "wsc.dll" to initiate a DLL sideloading chain. That DLL then contacted the same server to fetch a text file named after the device hostname obtained during profiling; that text file was an MSI installer containing an obfuscated JavaScript backdoor inside MSI custom actions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildGRIMWEDGE: in-memory backdoor with a command loop to a C2
The MSI-installer-delivered backdoor is called GRIMWEDGE. Once executed, GRIMWEDGE "enters a persistent command loop that polls a command-and-control (C2) server ('ocr.opusaccel[.]top')" to receive instructions that are executed in memory via eval(). Volexity enumerated the backdoor’s supported commands, which include Info, Dir, Mkdir, Del, Tasklist, Taskkill, Type (reads up to 5 MB), Run (executes a command in a hidden window), and an Upload sequence that supports chunked transfers and a commit step to write the reassembled file to disk.
On the limits of the implant, Volexity emphasized that "The code has no built-in persistence, lateral movement, or exfiltration mechanism beyond the file-read and upload commands." In other words, GRIMWEDGE provides an initial foothold sufficient for reconnaissance, retrieving files of interest, and deploying additional tooling via Run and Upload, but does not itself implement an advanced lateral-movement or persistence framework.
JungleBamboo (APT31) using the same chain: SUPERSTOMP and LONGTALE
Volexity also observed a second China-nexus actor, JungleBamboo (aka APT31), leveraging the same Chrome-Windows exploit chain "around the same time." In that activity the chain deployed a loader named SUPERSTOMP, which then installed LONGTALE — also referred to as GemStone — a credential-stealing Chrome extension hosted on a remote server. The extension masqueraded as a Google Gemini extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei) to evade detection.
Volexity described LONGTALE’s capabilities as including keylogging and form capture, cookie and session theft, screenshot capture driven by C2-supplied keywords, bulk exfiltration of keystrokes, cookies, storage data, navigation history and session metadata at roughly 30-second intervals, and remote command-and-control. The researchers noted that "LONGTALE lacks even a basic remote code execution command" and suggested the actor may have judged the extension’s extensive information-theft features sufficient for credential theft and surveillance objectives.
Patch gap in Chromium vs. Chrome and the accelerated release cadence
One operational detail stands out: the necessary fixes for the two Chrome flaws were pushed to the open-source Chromium codebase but had not been incorporated into a stable Google Chrome release, creating a patch gap that left Chrome users vulnerable. Volexity observed that this produced "an unusual case of two N-day bugs that were addressed in Chromium, but not in Chrome," effectively making them zero-days for Chrome until official releases arrived.
Volexity also noted a timing element: Chrome had relied on a four-week release cycle for major milestone releases until "last week (it's every two weeks now)," and that attackers may have sought to exploit the window before official stable releases closed it. The researchers warned that "patch-gap vulnerabilities present an even greater risk, as they create an additional time window for threat actors to conduct exploitation campaigns [...] as large language models become more popular and effective for rapid vulnerability research and exploit development."
What this means for technologists, policymakers, and NGOs
- Technologists and security teams: Watch for chains that combine reflected XSS to redirect to exploit infrastructure, and monitor for signs of sideloading and MSI-based JavaScript execution. Defenders should pay attention to domains such as ocr.opusaccel[.]top and artifacts named msgbox.exe and wsc.dll when triaging incidents.
- Policymakers and regulators: The incident highlights a window between upstream open-source fixes and downstream stable releases that can be exploited; that patch-gap dynamic may warrant attention when assessing software supply-chain risk models and disclosure timelines.
- NGOs and targeted organizations: UTA0560’s campaign used tailored spear-phishing that relied on a legitimate university website vulnerable to reflected XSS. Organizations that receive threat-informed phishing should prioritize patching known XSS flaws on externally facing sites and scrutinize inbound links that resolve to third-party domains.
Volexity’s account shows a compact, multi-stage exploitation model: weaponized web redirects, a three-CVE chaining to break out of the browser, a small loader that initiates DLL sideloading, and a memory-resident JavaScript backdoor that gives operators a lightweight but effective foothold. The near-simultaneous appearances of UTA0560 and JungleBamboo using the same chain raise the question the researchers pose — whether the exploit was sold or disseminated after rapid development — and underscore the operational impact of patch gaps in a fast-moving software ecosystem.
