"Critical Mozilla Firefox Zero-Day Allows Code Execution"

Mozilla has recently patched a critical security vulnerability in its Firefox Web browser that's being actively exploited in the wild.  Tracked as CVE-2024-9680, the vulnerability is a use-after-free issue in Animation timelines, with attackers exploiting it to execute arbitrary code.  It carries a CVSSv3 vulnerability severity rating of 9.8 out of 10 and has a low attack complexity.  Mozilla noted that no privileges or user interaction is needed to exploit the flaw successfully.  The Web browser vulnerability affects Firefox 131.0.2, Firefox ESR 128.3.1, and Firefox ESR 115.16.1.  Users should upgrade to version 131.0.2 in Firefox and to versions 115.16.1 or 128.3.1 for Firefox ESR to fix the vulnerability and thwart potential exploitation.

Dark Reading reports: "Critical Mozilla Firefox Zero-Day Allows Code Execution"