The 27-Day Window: What the BlueMoon Campaign Teaches About Commit-to-Release Gaps

Proofpoint disclosed the BlueMoon campaign: a fix for Chrome V8 vulnerability CVE-2026-85046 was committed to the public Chromium repository on August 7, 2026, but stable Chrome received the patch only on September 3. During those 27 days, attackers reconstructed a working exploit from the open commit, possibly with AI assistance.

• CVE-2026-85046: Chromium fix on August 7, Chrome Stable patch on September 3
• Gap between public commit and release was 27 days
• Exploit reconstructed from open commit, signs of AI assistance
• Defenders advised to monitor commits, not just CVEs