Actively exploited in the wild
Mozilla Firefox Use-After-Free Vulnerability
Mozilla - Firefox · Listed in the CISA KEV since 2024-10-15. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-9680
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
Risk Assessment
An attacker can execute code in the browser or mail client, potentially leading to session hijacking, data theft, or malware installation.
Recommendation
Update Firefox and Thunderbird to the latest patched versions.
Original NVD description (English source)
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.