Mozilla has issued an urgent security update for its Firefox browser, targeting a critical vulnerability actively exploited in the wild. The flaw, CVE-2024-9680, relates to a use-after-free bug in the browser’s animation timeline management.
This vulnerability allows attackers to leverage freed memory, inserting malicious code that could lead to remote code execution. In this case, the flaw resides in Firefox’s Web Animations API, which synchronises animations on web pages.
Mozilla confirmed that attackers have already been exploiting this flaw to execute code within the content process, posing a serious threat to users.
In its security bulletin, Mozilla stated, “An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild.”
CVE-2024-9680 impacts Firefox’s standard and extended support releases (ESR). Mozilla is urging users to upgrade to the following versions to mitigate the risk immediately:
- Firefox 131.0.2
- Firefox ESR 115.16.1
- Firefox ESR 128.3.1
Given the vulnerability’s nature and confirmed exploitation, upgrading to the latest version is crucial for all users. The update process is straightforward: users can navigate to the browser’s Settings menu, select Help, and click on About Firefox to trigger an automatic update. A restart will apply the new fixes.
Mozilla has not disclosed specific details on how attackers target victims or which groups are behind these attacks; the active nature of the exploitation elevates the need for immediate action.
The vulnerability allows malicious actors to execute code within Firefox, which could compromise systems and lead to broader security breaches.
This is only the second time Mozilla has had to address a zero-day vulnerability in Firefox this year, reports BleepingComputer. In March 2024, the company patched two critical vulnerabilities — CVE-2024-29943 and CVE-2024-29944 — after they were demonstrated during the Pwn2Own Vancouver hacking competition.
In the News: Star Health confirms data breach weeks after cyberattack
