BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

The BlueMoon exploit kit weaponizes three unpatched zero-day vulnerabilities — two in Chrome and one in Windows — chaining them together to achieve sandbox escape and full privilege escalation without requiring any user patches to have been missed, because these were zero-days at time of exploitation. The rapid adoption by multiple nation-state and potentially financially motivated threat actors underscores how commoditized exploit kits dramatically lower the skill barrier for sophisticated attacks. The suspected use of AI in the kit's development signals a dangerous acceleration in the pace at which zero-days can be packaged and distributed. Organizations that lack rapid response protocols and browser/OS update hygiene are disproportionately exposed when zero-days of this severity emerge.