Mozilla has disclosed and patched a critical use-after-free vulnerability in Firefox and Firefox Extended Support Release (ESR) which is actively being exploited in the wild. The flaw, tracked as CVE-2024-9680, was discovered by ESET researcher Damien Schaeffer, and impacts the Animation timeline component within Firefox’s Web Animations API. This vulnerability allows attackers to execute arbitrary code in the browser’s content process by manipulating freed memory, making it highly dangerous. The National Vulnerability Database (NVD) assigned it a CVSS score of 9.8/10, citing its low complexity and the fact that no user interaction or privileges are required for a successful exploit. In response, cybersecurity agencies in Canada, Italy, and the Netherlands have issued their own advisories due to the potential damage a successful attack could cause, despite the Dutch agency rating the likelihood of exploitation as medium. Mozilla has addressed the issue in Firefox 131.0.2 and ESR versions 115.16.1 and 128.3.1, and users are strongly urged to update immediately. This is the first major zero-day vulnerability patched by Mozilla since March, when it addressed similar critical issues demonstrated at the Pwn2Own Vancouver 2024 hacking competition. With the threat of the vulnerability being weaponized through drive-by downloads or watering hole attacks, ensuring that all users are on the latest versions is essential to prevent further exploitation. CTIX analysts recommend that readers make it a practice to regularly check to ensure their browsers are up-to-date with the latest patches to prevent exploitation.