CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
Description
CVE-2024-9680 is a critical use-after-free vulnerability in Mozilla Firefox's Animation timelines component that allows an attacker to achieve code execution in the browser's content process. The flaw affects Firefox versions before 131.0.2, Firefox ESR before 128.3.1 and 115.16.1, and Thunderbird before 131.0.1, 128.3.1, and 115.16.0. With a CVSS v3.1 base score of 9.8 (CRITICAL), no authentication or user interaction required for the network attack vector, and confirmed exploitation in the wild, this vulnerability represents a severe browser security threat. CISA added CVE-2024-9680 to the Known Exploited Vulnerabilities catalog with a known ransomware nexus, and its EPSS score of 31.35% at the 96.7th percentile confirms active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | < 115.16.1; < 131.0.2; >= 128.1.0, < 128.3.1 |
| mozilla | thunderbird | < 115.16.0; >= 128.0.1, < 128.3.1; 131.0 |
| debian | debian linux | 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1923344(Issue Tracking, Permissions Required)
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039(Not Applicable, Patch, Vendor Advisory)
- https://www.mozilla.org/security/advisories/mfsa2024-51/(Vendor Advisory)
- https://www.mozilla.org/security/advisories/mfsa2024-52/(Vendor Advisory)
- https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992(Issue Tracking)
- https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2024-9680 exploits a use-after-free weakness in Firefox's Animation timelines implementation. A use-after-free occurs when a program continues to reference memory after it has been freed, and an attacker can manipulate the freed memory to contain malicious data. In this case, the Animation timeline object is freed but a dangling pointer remains, allowing an attacker to reclaim the freed memory with controlled content and trigger code execution when the stale pointer is subsequently dereferenced during animation processing.
Learn more: CWE-416 — Use After Free
Impact Analysis
The impact of CVE-2024-9680 is severe, with Confidentiality (High), Integrity (High), and Availability (High) fully compromised. The CVSS vector indicates a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N). While the CVSS vector suggests no user interaction, in practice the victim must visit a malicious web page or be redirected to one; the "no user interaction" rating reflects that no additional action beyond normal browsing is needed. Code execution in the content process provides the attacker with the ability to read sensitive browser data, execute arbitrary commands within the process sandbox, and potentially chain with sandbox escape vulnerabilities for full system compromise. The confirmed ransomware nexus (Ransomware=Known) indicates that exploitation has been observed in campaigns that ultimately deploy ransomware. Firefox's large global user base, including privacy-conscious users and organizations, makes this vulnerability exceptionally high-impact. The EPSS score of 31.35% at the 96.7th percentile reflects targeted but significant exploitation activity, typical for browser zero-day vulnerabilities that are often used in targeted attack campaigns rather than mass exploitation.
Exploit Maturity
CVE-2024-9680 was exploited as a zero-day in the wild before Mozilla released patches, demonstrating maximum exploit maturity for a browser vulnerability. Mozilla acknowledged active exploitation in their security advisories MFSA 2024-51 and MFSA 2024-52, and CISA confirmed exploitation by adding it to the Known Exploited Vulnerabilities catalog with a known ransomware association. The EPSS score of 31.35% at the 96.7th percentile indicates active targeted exploitation. The vulnerability was tracked in Mozilla Bug 1923344, though details are restricted to prevent further exploitation. Browser use-after-free vulnerabilities of this caliber are typically weaponized by advanced threat actors and exploit brokers, and the ransomware nexus suggests the exploit was either sold to or developed by ransomware-affiliated groups. The rapid patch cycle, with Mozilla releasing emergency updates outside their normal schedule, underscores the severity.
Remediation
-
Update Firefox and Thunderbird immediately to Firefox 131.0.2 or later, Firefox ESR 128.3.1 or later, Firefox ESR 115.16.1 or later, Thunderbird 131.0.1 or later, Thunderbird 128.3.1 or later, or Thunderbird 115.16.0 or later, as documented in Mozilla's security advisories MFSA 2024-51 and MFSA 2024-52.
-
Enable automatic updates for all Mozilla products across the organization to ensure rapid deployment of security patches. Configure enterprise update policies through Group Policy (Windows) or managed preferences (macOS/Linux) to prevent users from deferring critical security updates.
-
Deploy browser isolation or sandboxing solutions to contain the impact of browser-based exploits. While Firefox has its own content process sandbox, additional network-level browser isolation can prevent exploitation from reaching the endpoint entirely.
-
Review endpoint security telemetry for indicators of compromise including unusual child processes spawned by Firefox, unexpected network connections from browser processes, and signs of sandbox escape attempts. Focus on the time window between the vulnerability's disclosure and patch deployment.
-
Consider implementing exploit mitigation technologies such as Windows Defender Exploit Guard, Enhanced Mitigation Experience Toolkit (EMET) successor features, or Linux hardening measures that can detect and block use-after-free exploitation techniques at the operating system level.
Technical Details
CVE-2024-9680 is a use-after-free vulnerability in Mozilla Firefox's Animation timelines component. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N), with Unchanged scope (S:U) and maximum impact across confidentiality, integrity, and availability. The vulnerability resides in the Web Animations API implementation, specifically in how Firefox handles Animation timeline objects. When certain animation operations are performed in a specific sequence, an Animation timeline object can be freed while references to it still exist in other parts of the rendering engine. An attacker crafts a web page that triggers this specific sequence of animation operations, causing the timeline object to be freed prematurely. The attacker then performs carefully timed memory allocations to reclaim the freed memory region with controlled content. When the rendering engine subsequently accesses the stale pointer to the freed timeline object, it reads the attacker-controlled data, leading to arbitrary code execution within the content process. The content process sandbox limits the immediate impact, but the attacker gains the ability to read browser memory, steal session tokens, and potentially chain with additional vulnerabilities to escape the sandbox. The affected products span Firefox, Firefox ESR, and Thunderbird, as they share the same Gecko rendering engine.
Frequently Asked Questions
Is CVE-2024-9680 being actively exploited?
Yes, Mozilla confirmed that CVE-2024-9680 was being exploited in the wild as a zero-day before patches were available. CISA added it to the Known Exploited Vulnerabilities catalog with a known ransomware nexus, and the EPSS score of 31.35% at the 96.7th percentile confirms ongoing targeted exploitation.
What products are affected by CVE-2024-9680?
Mozilla Firefox before 131.0.2, Firefox ESR before 128.3.1 and 115.16.1, and Thunderbird before 131.0.1, 128.3.1, and 115.16.0 are affected. Debian Linux 11.0 packages of Firefox are also affected. All Mozilla products using the Gecko rendering engine are impacted.
How do I fix CVE-2024-9680?
Update Firefox to version 131.0.2 or later, Firefox ESR to 128.3.1 or 115.16.1, and Thunderbird to 131.0.1, 128.3.1, or 115.16.0. Enable automatic updates to ensure rapid deployment of future emergency patches.
What is a use-after-free vulnerability?
A use-after-free occurs when a program continues to use a memory reference after the memory has been freed. Attackers exploit this by manipulating the freed memory to contain malicious data, so when the program reads the stale reference, it executes attacker-controlled code instead of the original data. In browsers, this typically leads to arbitrary code execution within the rendering process.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.