{"id":"CVE-2024-9680","published":"2024-10-09T13:15:12Z","modified":"2026-08-04T05:16:32Z","title":"Mozilla Firefox Use-After-Free Vulnerability","vendor":"Mozilla","product":"Firefox","tier":"core","eol":null,"description":{"text":"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.","provenance":"source","from":"NVD"},"summary":{"text":"A use-after-free flaw in the Animation timelines component of Mozilla Firefox allows memory corruption that can lead to code execution inside the content process. An attacker can exploit it remotely over the network with no privileges or user interaction required, as the attack vector and privilege metrics indicate.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:10:57Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.23184,"percentile":0.97769,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2024-10-15","dueDate":"2024-11-05","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-10-09","exploitedFirstSeen":"2024-10-09","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2024-10-09"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9680","date":"2024-10-09"},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/","date":"2024-10-09"},{"url":"https://blog.mozilla.org/security/2024/10/11/behind-the-scenes-fixing-an-in-the-wild-firefox-exploit/","date":"2024-10-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-10-15"},{"url":"https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-discovers-mozilla-and-windows-zero-day-zero-click-vulnerabilities-exploited-by-russia-aligned-romcom-apt-group/","date":"2024-11-26"},{"url":"https://www.welivesecurity.com/en/eset-research/romcom-exploits-firefox-and-windows-zero-days-in-the-wild/","date":"2024-11-26"},{"url":"https://45734016.fs1.hubspotusercontent-na1.net/hubfs/45734016/GLOBAL%20CYBER%20THREAT%20REPORT%202024%20.pdf","date":"2025-01-08"},{"url":"https://www.cyfirma.com/research/apt-quarterly-highlights-q4-2024/","date":"2025-02-06"},{"url":"https://www.gendigital.com/blog/insights/reports/threat-report-q4-2024","date":"2025-02-06"}],"evidenceTotal":27,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1923344","tags":["Issue Tracking","Permissions Required"]},{"url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039","tags":["Not Applicable","Patch","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-51/","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-52/","tags":["Vendor Advisory"]},{"url":"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992","tags":["Issue Tracking"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Browser content exploitation via drive-by rendering","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"exploiting a use-after-free in Animation timelines","start":73,"end":123}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploit yields code execution in content process","mappingType":"primary_impact","evidence":[{"from":"description","quote":"achieve code execution in the content process","start":24,"end":69}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-50087","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50087","exploited":true,"exploitedSince":"2024-10-15","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2024-10-17","earliestUrl":"https://github.com/tdonaworth/Firefox-CVE-2024-9680","repos":[{"name":"tdonaworth/Firefox-CVE-2024-9680","url":"https://github.com/tdonaworth/Firefox-CVE-2024-9680","stars":11,"created":"2024-10-17"},{"name":"moscovium-mc/Tor-0day-JavaScript-Exploit","url":"https://github.com/moscovium-mc/Tor-0day-JavaScript-Exploit","stars":10,"created":"2025-11-07"},{"name":"PraiseImafidon/Version_Vulnerability_Scanner","url":"https://github.com/PraiseImafidon/Version_Vulnerability_Scanner","stars":1,"created":"2025-01-02"}]},"first":{"date":"2024-10-17","source":"PoC-in-GitHub","url":"https://github.com/tdonaworth/Firefox-CVE-2024-9680"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"related","techniques":["T1189","T1203"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2024-10-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9680","provenance":"source"},{"date":"2024-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2024-10-15","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-10-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50087","provenance":"source"},{"date":"2024-10-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/tdonaworth/Firefox-CVE-2024-9680","provenance":"source"}],"speed":{"daysToPublicExploit":8,"firstExploitFrom":"PoC-in-GitHub","daysToKev":6},"priority":{"score":76.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 753 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.55,"detail":"percentile 0.9777"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-mozilla-firefox-cwe-416"}}