CVE-2024-9680

CVE-2024-9680 is a critical use-after-free vulnerability in Firefox and Thunderbird's Animation timelines, allowing attackers to achieve code execution in the content process. This flaw affects Firefox versions prior to 131.0.2 and 128.3.1 (ESR), and Thunderbird versions prior to 131.0.1, 128.3.1, and 115.16.0. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk as it can be exploited remotely without user interaction, leading to complete compromise of confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, including by known ransomware campaigns, and has garnered significant community discussion and media coverage, despite no public exploit code being available on platforms like Metasploit or ExploitDB.