Mozilla released out-of-band security updates addressing CVE-2024-9680, a critical use-after-free vulnerability (CVSS 9.8) in Firefox’s Web Animations API. The flaw stems from improper object lifetime management in the Animation timelines subsystem, where freed timeline memory objects remain accessible to script execution. A remote adversary hosting a malicious web page can trigger memory corruption by manipulating timeline state during DOM mutation callbacks, achieving arbitrary shellcode execution within the sandboxed unprivileged content process (firefox.exe).

Discovered and reported by ESET researcher Damien Schaeffer, the zero-day was actively weaponized in watering-hole and targeted drive-by attacks by Russian cyberespionage group RomCom (Storm-0978). Attackers chained CVE-2024-9680 with a Windows Task Scheduler privilege escalation flaw (CVE-2024-49039) to escape the browser sandbox, deploy reflective PE loaders, and install the RomCom backdoor without user interaction. Mozilla addressed the flaw in Firefox 131.0.2, Firefox ESR 128.3.1, and Firefox ESR 115.16.1, with downstream emergency fixes deployed in Tor Browser 13.5.7.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Browser render engine memory corruption provides remote attackers an immediate zero-click entry point, completely invalidating perimeter defenses when chained with local OS privilege escalation flaws to break content sandboxing.
• Bullet 2 — Strategic & Defender Imperative: Enterprise endpoint administrators must prioritize emergency updates across all standard and ESR Firefox installations, ensure browser isolation or sandboxing policies are enforced, and monitor endpoint process spawning from browser trees.