Mozilla · Firefox
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
What it is
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
CISA: Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: November 5, 2024
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | Security Feature Bypass | Firefox | High 8.8 | 69% |
| Mar 7, 2022 | Use-After-Free | Firefox | High 8.8 | 14% |
| Mar 7, 2022 | Use-After-Free | Firefox | Critical 9.6 | 2.4% |
| Mar 3, 2022 | Information Disclosure | Firefox | Medium 6.5 | 6.7% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.