Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Chrome Zero Day. Show all posts
Cyber Security
AI Agent AI Chatbot AI research AI technology ChatGPT. OpenAI Chrome Chrome Zero Day Cyber Security

AI Agents Build Chrome Zero-Day Exploit in Six Days, Winning $250,000 Reward

 

AI-powered security agents developed a Google Chrome exploit within six days and earned XBOW company $250,000 from Google. The exploit involved an intricate chain of attacks that used to require extensive manual work and unique expertise in the past. 

Researchers at XBOW utilized OpenAI’s publicly available GPT-5.6 Sol model to find and combine three Chrome vulnerabilities, resulting in an exploit that enables code execution in Chrome when a victim loads a web page. The researcher group spent nearly $40,000 on the AI-powered process, in addition to the extensive preparations before the six-day research window. V8 JavaScript Engine, WebP image codec, and Crashpad constitute Google Chrome’s fundamental components. 

The researchers discovered an intricate attack chain that involved all three elements. Exploiting Chrome’s reporting tool, one could gain arbitrary code execution by inducing the component into a special state. The researchers found two zero-day flaws in Chrome, namely,CVE-2026-85045 and CVE-2026-78952. Google patched the flaws in Chrome on August 25 and September 3, respectively. The software received updates in versions 152.0.7977.65 and 152.0.7977.82. 

If you are a Windows user, you need to restart Chrome and ensure it is at least version 152.0.7977.82. It is unclear whether any attackers used the Chrome flaw to infiltrate systems. However, Chrome is a popular browser with an estimated billion Windows users worldwide, any successful attack would have severe consequences. The article concludes by emphasizing the collaboration between AI-powered agents and human counterparts. Apparently, the AI-powered system did not do everything automatically. 

In addition to the preparatory steps, the researchers engaged in the preparatory steps and the exploit development itself. Thus, the new possibilities opened up by AI research tools is that researchers are no longer limited by their knowledge and skills to develop an intricate attack chain. Google Vulnerability Reward Program encourages security researchers to report bugs they discover in the company’s products. 

In this particular case, XBOW received $250,000 from Google for the research. The result highlights the relevance of browser security research and the significance of the work of security researchers who protect users from attacks. On the one hand, the researchers increased the potential attack surface of Chrome. 

However, the exploit they discovered is chained in a way that allows Chrome users to protect themselves better. The new possibilities in security research, enabled by artificial intelligence, change the game for browsers’ security. Attackers can develop sophisticated exploits faster now, and the protection-focused counterparts should respond by promptly distributing and installing updates.
Read more »
Zero Day Exploit
BlueMoon Exploit Kit Chrome Zero Day Chromium Vulnerability cyber espionage Proofpoint Vulnerabilities and Exploits Windows Zero Day Zero Day Exploit

Several Chinese Hacking Groups Observed Using Identical Chrome Zero-Day Exploit


Based on cybersecurity firm Proofpoint, four cyber-espionage groups, most of which are linked to Chinese state intelligence, have been exploiting the same previously unknown Chrome vulnerability since late August, according to the firm. The activity involved an exploit kit, referred to as BlueMoon, that was used on U.S. defense contractors, non-profit organizations, and government agencies throughout Southeast Asia. 

There were separate campaigns operated by each group that targeted different targets, deployed different malware and utilized different command-and-control infrastructure, but utilized the same exploit kit for the compromise of Chrome browsers. According to Proofpoint, two additional groups may have utilized BlueMoon, suggesting that its reach may extend far beyond activities identified so far. 

The use of the kit has raised questions regarding how different threat groups were able to achieve the same capability so quickly. A number of possibilities have been explored by researchers, including Chinese government sources, shared contractors, and commercial providers providing offensive tools to multiple actors. 

Proofpoint has not yet identified a definitive source for the exploit kit BlueMoon exploited a vulnerability in Chromium, the open-source project that runs Chrome, to exploit this vulnerability. The corresponding changes to Chrome released a few weeks later, even though a vulnerability had been fixed in Chromium in early August. As a result of access to public code changes during that period, attackers were able to assess the fix and develop an exploit to discover the underlying weakness. 

Until an upstream fix was released to Chrome users, there was a narrow window for exploitation. According to Proofpoint researchers, reverse engineering and weaponizing patches within such a short period of time was not uncommon before, but the BlueMoon activity indicates that attackers are developing more rapid exploits from publicly available fixes. By combining multiple browser vulnerabilities with a Windows vulnerability, BlueMoon is able to gain control of a targeted system. 

Once the browser compromise has been completed, it is handed over to malware selected by the threat group that is employing it. APT31, also known as TA412, is the first confirmed user of BlueMoon. The group used it to attack U.S. non-governmental organizations, mining companies, and commodity traders via phishing messages. 

The exploit chain for BlueMoon was based upon two vulnerabilities in Chrome's V8 JavaScript and WebAssembly engines, followed by a privilege-escalation flaw in Windows. The attackers were able to break out of Chrome's security sandbox using the browser vulnerabilities, and then used the Windows vulnerabilities to gain higher privileges on affected systems by exploiting the Windows flaw. 

By injecting code into the Chrome broker process after the chain had completed, BlueMoon could retrieve executables and execute them from the temporary directory of the system using the built-in curl utility. Proofpoint identified several packaging variants of the kit, but the key exploitation sequence and loading process remained largely unchanged. Additionally, evidence has been found to indicate artificial intelligence may have played a role in the rapid development of BlueMoon. 

During the development process, researchers found detailed debugging comments, diagnostic information, and a Markdown handover document. Several of the references to Google V8 challenges were not sufficient to establish whether or not artificial intelligence was responsible for developing the exploit. 

According to Proofpoint, however, the evidence was insufficient to establish how artificial intelligence was used. Especially significant is the timing of the activity because it appears that the attackers used publicly available Chromium fixes before those fixes were released in stable browser versions. While many systems were still vulnerable to attacks, exploit developers had the opportunity to examine the patches, identify the underlying weaknesses, and prepare attacking code to exploit these vulnerabilities. 

A fix has been provided for all three vulnerabilities used by BlueMoon, including the privilege-escalation flaw in Microsoft's September 2026 security updates for Windows. Despite the fact that security updates are still being distributed across Chromium-based browsers during this period, the exploit kit may continue to pose a threat during this time. 

The rapid movement of BlueMoon between multiple espionage campaigns could indicate that the costs of developing advanced browser exploits are declining, according to Proofpoint. Furthermore, the researchers noted that the kit is not limited to Chinese activities, since it is relatively straightforward to deploy. This makes it useful to other espionage and financially motivated threat actors as well.
Read more »
Subscribe to: Posts (Atom)