flawopen.com/インシデント/BlueMoonゼロデイ多段攻撃：Chrome V8 RCEとWindows ALPC特権昇格
銀行の窓口を想像してください。窓口係は頑丈な防弾ガラス（Chromeサンドボックス）の向こう側に隔離されており、金庫の鍵は持っていません。攻撃者は細工した書類を使って窓口係を騙し、窓口の中を乗っ取りました（Chrome V8 RCE）。しかし防弾ガラスに阻まれて外には出られません。そこで攻撃者は、窓口と地下の管理室を繋ぐ連絡用エアシューター（Windows ALPC）に目を付け、規格外の巨大なシリンダーを無理やり送り込んで地下設備を物理的に破損させ、ビル全体のマスターキーを内部から強制解除させました（SYSTEM権限奪取）。
In early September 2026, cybersecurity researchers and threat intelligence teams discovered a sophisticated, actively exploited zero-day attack campaign dubbed 'BlueMoon'. The threat actors deployed a zero-click/one-click exploit chain targeting fully updated installations of Google Chrome on Microsoft Windows.
The attack chained two zero-days patched within days of each other:
153.0.8010.36/.37.This incident is a textbook illustration of modern systems exploitation. Because Chromium enforces rigorous process sandboxing—locking renderer processes in low-integrity AppContainers with restricted system call tables—compromising the browser engine alone was insufficient for the attackers to steal files or persist on the victim's machine. To escape containment, the attackers weaponized the ALPC subsystem exposed to the sandboxed renderer, compromising the Windows NT kernel and achieving unconstrained NT AUTHORITY\SYSTEM privileges.
In V8's JIT optimization pipeline, the compiler optimizes array operations by calculating integer range bounds. Due to an arithmetic truncation bug in Turbofan's Typer phase when folding 64-bit integer bitwise operations, the engine erroneously concluded that an array index could never exceed array.length. It eliminated runtime bounds checks, allowing a crafted JavaScript loop to write arbitrary pointers past the end of the backing store on the V8 heap.
Once remote code execution was achieved inside the renderer process, the attacker encountered Chrome's defense-in-depth perimeter: Win32k system calls were blocked, direct disk writes were denied by Windows Mandatory Integrity Control (Low Integrity), and outbound raw socket creation was prohibited. The attacker could not run cmd.exe or persist.
To escape the sandbox, the attacker leveraged the fact that sandboxed renderers must still communicate with system IPC endpoints via ALPC. The attacker sent an intricately malformed ALPC message structure with mismatched message length headers. In ntoskrnl.exe, the message handling routine allocated a kernel pool buffer based on the declared data size, but copied data based on the total message length, triggering an out-of-bounds heap write into the adjacent Paged Pool. The attacker corrupted an adjacent security token object to grant themselves SeDebugPrivilege and SYSTEM credentials.
// 1. Conceptual V8 Turbofan Typer Flaw (CVE-2026-87491)
Type Typer::Visitor::TypeSpeculativeNumberBitwiseOr(Node* node) {
// Bug: Underflow/truncation in 64-bit range inference
// Compiler statically infers range [0, 10], but runtime value can reach 0x7FFFFFFF!
return Type::Range(min_val, max_val, zone());
}
// 2. Conceptual Windows Kernel ALPC Heap Copy Flaw (CVE-2026-85880)
NTSTATUS AlpcpCopyMessageData(PALPC_MESSAGE Msg, PVOID Buffer) {
// Bug: Buffer allocated from declared DataLength, but copy uses TotalLength
ULONG allocSize = Msg->Header.u1.s1.DataLength;
PVOID poolBlock = ExAllocatePoolWithTag(PagedPool, allocSize, 'CplA');
// HEAP OVERFLOW: TotalLength > DataLength overwrites adjacent pool memory!
RtlCopyMemory(poolBlock, Msg->PortMessage.Data, Msg->Header.u1.s1.TotalLength);
return STATUS_SUCCESS;
}
// 1. Fixed V8 Turbofan Bounds Validation
Type Typer::Visitor::TypeSpeculativeNumberBitwiseOr(Node* node) {
// Fix: Strict conservative bounding preventing speculative check elimination
if (!IsSafeIntegerRange(min_val, max_val)) return Type::Any();
return Type::Range(SafeClamp(min_val), SafeClamp(max_val), zone());
}
// 2. Fixed Windows Kernel ALPC Size Verification
NTSTATUS AlpcpCopyMessageData(PALPC_MESSAGE Msg, PVOID Buffer) {
// Fix: Explicit sanity check validating header length consistency
if (Msg->Header.u1.s1.TotalLength < Msg->Header.u1.s1.DataLength) {
return STATUS_INVALID_PARAMETER;
}
// Allocate buffer matching the actual copy length, strictly bounded
PVOID poolBlock = ExAllocatePoolWithTag(PagedPool, Msg->Header.u1.s1.TotalLength, 'CplA');
if (!poolBlock) return STATUS_INSUFFICIENT_RESOURCES;
RtlCopyMemory(poolBlock, Msg->PortMessage.Data, Msg->Header.u1.s1.TotalLength);
return STATUS_SUCCESS;
}
# Sysmon Event ID 1: Detect suspicious child processes spawned from chrome.exe
EventID=1 AND ParentImage="*\chrome.exe" AND Image IN ("*\cmd.exe", "*\powershell.exe", "*\whoami.exe")
# ETW: Microsoft-Windows-Kernel-Memory: Monitor NonPaged/Paged Pool ALPC corruption
logman start AlpcPoolTrace -p "Microsoft-Windows-Kernel-Memory" 0x80 -ets
# Yara: Rule targeting the BlueMoon V8 JIT shellcode loader stage
rule BlueMoon_V8_Stage1 { strings: $c = { 48 8B 04 24 48 83 C0 ?? 48 89 04 24 } condition: $c }
Win32kLockdown and RendererAppContainer policies are actively enabled via enterprise GPO.chrome.exe or any sandboxed utility process spawns system binaries (cmd.exe, powershell.exe).