# Four hacking groups exploit identical Chrome-Windows vulnerability chain

BlueMoon kit combines 3 patched flaws to install malware across outdated systems

- **Source:** [Ars Technica - All content](https://brifing.si/source/b728770c-8dda-457a-8986-84879c9fc42c)
- **Published:** 2026-09-09
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/>
- **On Brifing:** https://brifing.si/s/75fcc89a-012d-495c-a5db-4fbc4cc62be2

## Multi-group attack campaign

At least four hacking groups, some with ties to China, are actively using the BlueMoon exploit kit targeting both Chromium browsers and Windows systems. The kit chains together three critical vulnerabilities to enable arbitrary malware installation. Security firm Proofpoint identified the coordinated attacks occurring simultaneously across multiple threat actor networks, suggesting possible shared infrastructure or collaboration between groups.

## Technical vulnerability details

BlueMoon exploits two Chromium vulnerabilities and one Windows kernel flaw affecting Windows 10 (2018 Update through 2004), Server 2019/2022, and initial Windows 11 releases. All three vulnerabilities received patches within the past day. The Windows kernel vulnerability (CVE-2023-32456) allows privilege escalation, while the Chromium flaws (CVE-2023-34235 and CVE-2023-34236) enable remote code execution when combined.

## Unusual attack characteristics

Unlike typical stealthy campaigns, these attacks are widespread and visible. Hackers usually conserve new exploits to maximize their lifespan. Proofpoint suggests the groups are aggressively exploiting the 'patch gap' - the window between patch availability and actual user deployment. Chromium's complex supply chain means patches take days to weeks to reach all Chrome/Edge users, creating exploitable windows.

## AI acceleration factor

Researchers note AI tools likely accelerated vulnerability discovery. Machine learning models can analyze code changes and spot potential flaws faster than human researchers alone. This aligns with observed Chinese investments in AI-powered cyber tools. The rapid weaponization of these particular vulnerabilities suggests automated assistance in reverse-engineering patches to develop exploits.

## Enterprise risk assessment

Organizations still running unpatched Windows 10 or older Chromium-based browsers face immediate risk. Microsoft reports 32% of enterprise Windows devices remain on vulnerable versions. For Chromium browsers, the patch gap risk is compounded by extension vulnerabilities that often persist even after core browser updates. Security teams should prioritize patch verification and network segmentation.

## Supply chain implications

The attacks highlight weaknesses in software supply chains. Chromium's open-source nature means security depends on downstream implementers. Google may patch Chromium, but Microsoft, Brave, Opera etc. must independently integrate fixes. This fragmentation creates inconsistent protection timelines. Some enterprise browsers lag behind by weeks despite critical fixes being available.

## Attribution challenges

While some groups show Chinese ties, attribution remains difficult due to shared tool usage. BlueMoon's rapid proliferation suggests either tool leakage or intentional sharing between groups. The Chinese Ministry of State Security has historically supported both independent hacker groups and state-sponsored units, creating plausible deniability while advancing strategic objectives.

## Strategic cybersecurity shift

This campaign signals a shift toward rapid, widespread exploitation of known vulnerabilities before patches deploy. The combination of AI-assisted discovery and supply chain delays creates perfect attack conditions. Organizations must now assume vulnerabilities will be weaponized within hours of patch release, requiring automated update systems and real-time threat monitoring.

## Sources covering this story

- https://arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._