FlawOpen

flawopen.com/Incidents/bluemoon-chrome-v8-windows-alpc-september-2026

● BlueMoon · CVE-2026-85046 · September 2026 · High
FlawOpen Security Research

BlueMoon: three flaws crossed Chrome and Windows isolation boundaries

Proofpoint reported targeted BlueMoon campaigns chaining CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (V8 sandbox escape), and CVE-2026-85880 (Windows kernel LPE). Google and Microsoft each confirmed exploitation before their fixes; update Chromium browsers and Windows separately.[1], [2], [3], [4]

💡 Plain English Explainer (ELI5)

Imagine a sorter checking that every parcel contains books, then letting a visitor swap the contents before sorting by the old labels. That first mistake gives access to a locked sorting cage; a second flaw opens the cage, and a third tampers with the building’s access badges. Fixing one lock does not repair the other two.[1]

Core Concepts & Subsystem Terms

V8 / type confusion
V8 executes JavaScript. CVE-2026-85046 involved Array.prototype.sort assumptions invalidated by fill() changing the elements kind.[1], [2]
V8 sandbox / WebAssembly
The V8 sandbox isolates engine-managed memory within the renderer. CVE-2026-87491 used WebAssembly metadata corruption to cross that boundary; it is distinct from the renderer process sandbox.[1], [3]
ALPC / WNF / privilege
Advanced Local Procedure Call and Windows Notification Facility are kernel mechanisms implicated in CVE-2026-85880. The reported chain enabled SeDebugPrivilege, a process-debugging privilege.[1], [4]

Framework mappings

BlueMoon exploit-chain stages and patch decisions

Stage / CVE / boundaryWhat the sources establishDefender action
V8 JIT type confusion — CVE-2026-85046Proofpoint describes Array.prototype.sort comparator mutation through fill() invalidating an elements-kind assumption. Google says an exploit existed in the wild.Install Chrome/Chromium 152.0.7977.82/.83 (Windows/Mac) or .82 (Linux), or later; restart the browser. Google’s September 3 release contains the fix.
V8 sandbox escape — CVE-2026-87491Proofpoint reports WebAssembly module-metadata corruption crossing V8’s memory sandbox, distinct from the renderer-process sandbox. Google says an exploit existed in the wild.Install Chrome/Chromium 153.0.8010.36/.37 (Windows/Mac) or .36 (Linux), or later; restart the browser. Google’s September 8 release contains the fix.
Windows kernel LPE — CVE-2026-85880Proofpoint describes an ALPC/WNF path to SeDebugPrivilege and lists the older Windows builds targeted by the kit. Microsoft confirms exploitation before its September 8 updates. The kit’s target list is not a complete affected-version inventory.Install current supported Windows security updates, including the September 8, 2026 update or later; use MSRC for the OS-specific package and complete any required reboot. Patch Windows separately from Chrome.

Incident Timeline

2026-08-28

Proofpoint first observed BlueMoon activity.[1]

2026-09-03

Chrome Stable fixed CVE-2026-85046 in 152.0.7977.82/.83 for Windows and Mac, and .82 for Linux.[2]

2026-09-08

Chrome Stable fixed CVE-2026-87491 in 153.0.8010.36/.37 for Windows and Mac, and .36 for Linux; Microsoft addressed CVE-2026-85880 in its September updates. Microsoft confirmed that CVE-2026-85880 was exploited before the September 8 Windows security updates.[3], [4], [5]

Step-by-Step Attack Flow

Step 1

Observed delivery

Proofpoint saw targeted spearphishing campaigns deliver a link to the exploit kit. The browser stages required the recipient to open the link in a vulnerable Chromium-based browser.[1]

Step 2

V8 type confusion — CVE-2026-85046

Proofpoint describes an optimized Array.prototype.sort path whose type assumption could be invalidated when its comparator changed the receiver with fill(). The resulting type confusion was the chain’s initial renderer-stage vulnerability; Google said an exploit existed in the wild.[1], [2]

Step 3

V8 sandbox escape — CVE-2026-87491

Proofpoint reports corruption of WebAssembly module metadata to cross V8’s memory sandbox. This is separate from Chrome’s renderer-process sandbox; Google also said an exploit existed in the wild.[1], [3]

Step 4

Windows kernel LPE — CVE-2026-85880

Proofpoint reports an ALPC/WNF kernel path used to enable SeDebugPrivilege in the renderer on selected older Windows builds. Microsoft separately confirmed exploitation before its September 8, 2026 security updates.[1], [4]

Step 5

Renderer-process escape

With the browser stages and a supported Windows target, the reported chain could move from renderer compromise through the Windows LPE and into the parent browser process. The Python example below models only the stale-assumption lesson; it is not the exploit chain.[1], [4]

Source Code: Flaw vs. Secure Implementation

Safe Python illustration of invalidated assumptions, not V8 source, an exploit or a vendor patch. A benign callback can replace integers with strings after the initial check. The fix validates a bounded snapshot after the callback and performs no further callbacks while consuming it. Python raises an exception for the vulnerable string case; this does not emulate native memory corruption. Use only trusted, bounded callbacks and ordinary lists in this synchronous example.

UNPATCHED FLAW
def numeric_total(values, callback):
    if type(values) is not list or len(values) > 1024:
        raise ValueError("Invalid batch")
    if any(type(x) is not int for x in values):
        raise ValueError("Expected integers")
    callback(values)
    # The callback may have invalidated the type assumption.
    return sum(values)
HARDENED SECURE PATCH
def numeric_total(values, callback):
    if type(values) is not list or len(values) > 1024:
        raise ValueError("Invalid batch")
    callback(values)
    if len(values) > 1024:
        raise ValueError("Invalid batch")
    snapshot = tuple(values)
    if any(type(x) is not int or abs(x) > 1_000_000
           for x in snapshot):
        raise ValueError("Expected bounded integers")
    # Consume the validated snapshot without another callback.
    return sum(snapshot)

Engineering & System Hardening Checklist

Sources