CVE-2026-85880 ALPC/WNF kernel exploit enabling SeDebugPrivilege in Chrome rende

Ankit Mehta@Secvyn

•updated Sep 10, 2026•8•0•21

Detects anomalous behavior within a Chrome renderer process involving the acquisition of SeDebugPrivilege, preceded by ALPC, WNF, or reflective DLL loading activities. This pattern is indicative of the BlueMoon (CVE-2026-85880) kernel privilege escalation exploit chain, where a compromised low-integrity renderer leverages kernel vulnerabilities to gain elevated privileges.