CVE-2024-9680: critical vulnerability in Mozilla Firefox
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 23/2024Vulnerabilidade crítica no Firefoxread on gov.br ↗
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in how Firefox handles animation timelines allows attackers to run malicious code on your computer. This happens when the browser tries to use animation data that has already been deleted from memory, and criminals are actively exploiting it.
Use-after-free vulnerability in the animation timeline subsystem enables arbitrary code execution within the content process. The attack requires no user interaction beyond visiting a malicious webpage; successful exploitation compromises process isolation and grants attacker code execution with content process privileges. Active exploitation in the wild has been confirmed.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.