Firefox Critical Security Vulnerability: Ensure Browser Update Immediately
Mozilla has disclosed a severe security vulnerability affecting Firefox and Firefox Extended Support Release (ESR) that is currently being actively exploited in the wild.
The security flaw, identified as CVE-2024-9680, is categorized as a use-after-free flaw in the Animation timeline component.
“Exploiting a use-after-free in Animation timelines allowed an attacker to execute code in the content process,” mentioned Mozilla in a security advisory issued on Wednesday.
“There have been reports of malicious exploitation of this vulnerability.”
Security researcher Damien Schaeffer from ESET, a company based in Slovakia, is credited with the discovery and reporting of this vulnerability.
The problem has been resolved in the latest versions of the web browser
- Firefox 131.0.2
- Firefox ESR 128.3.1, and
- Firefox ESR 115.16.1.
There is currently no information available on the methods used to exploit this vulnerability in real-world attacks or the identities of the threat actors responsible for them.
Nevertheless, these remote code execution vulnerabilities could be utilized in various ways, either as part of a watering hole attack targeting specific websites or through a drive-by download campaign that deceives users into visiting fraudulent websites.
It is recommended that users update to the most recent version to protect themselves against active threats.
About Author
