CVE-2024-9680

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 6 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

30.81%

probability

This CVE has a 30.81% probability of being exploited in the next 30 days.

0% Top 96.8th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Use-after-free in Animation timeline

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-416 · Use After Free CWE-664 · Improper Control of a Resource Through its Lifetime CWE-666 · Operation on Resource in Wrong Phase of Lifetime CWE-672 · Operation on a Resource after Expiration or Release CWE-825 · Expired Pointer Dereference

Google Project Zero

Patched

Oct. 9, 2024

Reported by

Damien Schaeffer from ESET

Root Cause Analysis

???

Exploits & PoC

tdonaworth/Firefox-CVE-2024-9680

PoC CVE-2024-9680 — tdonaworth/Firefox-CVE-2024-9680

PraiseImafidon/Version_Vulnerability_Scanner

A vulnerability scanner for Firefox and Thunderbird that checks if your versions are out of date and susceptible to CVE-2024-9680.

2 repos — triés par ⭐ Rechercher sur GitHub ↗

Firefox Zero-Day Under Attack: Update Your Browser Immediately

TheHackerNews

Mozilla fixes Firefox zero-day actively exploited in attacks

BleepingComputer Oct 09, 2024

Google Reports 75 Zero-Days Exploited in 2024 — 44% Targeted Enterprise Security Products

TheHackerNews

Firefox and Windows zero-days exploited by Russian RomCom hackers

BleepingComputer Nov 26, 2024

Security Advisory 2024-107

CERT-EU Oct 11, 2024

RomCom Exploits Zero-Day Firefox and Windows Flaws in Sophisticated Cyberattacks

TheHackerNews

Signal Intelligence

Confidenceⓘ

95%

EPSS 30.81%

Mentions 6

Last Seen Nov 26, 2024

CNA Information

Analyst Note

CVE-2024-9680 is a critical use-after-free vulnerability in Firefox with a CVSS score of 9.8, confirmed active exploitation in the wild by threat actors including Russian RomCom hackers, and documented by reputable sources including BleepingComputer and CERT-EU. Mozilla has issued patches across multiple affected versions (Firefox, Firefox ESR, and Thunderbird), validating the vulnerability's authenticity and severity.