How BlueMoon Exploits Chrome CVE-2026-85046 and CVE-2026-87491

Key Takeaways BlueMoon Exploit Kit, first observed on August 28, 2026, turns visits to malicious websites into Windows malware execution. The kit chains two V8 vulnerabilities with a Windows kernel exploit to run payloads outside the browser sandbox. CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 enable V8 type confusion, sandbox escape, and kernel privilege escalation respectively.