Firefox Zero-day Vulnerability Currently Being Actively Exploited

Target Industry

Indiscriminate, opportunistic targeting.

Overview

Mozilla has recently disclosed a critical security flaw affecting both Firefox and Firefox Extended Support Release (ESR), which has been actively exploited in the wild. This vulnerability, identified as CVE-2024-9680, is a use-after-free bug in the Animation timeline component and carries a CVSS v3.1 base score of 9.8, underscoring its severe level of risk.

Impact

Exploiting this vulnerability allows attackers to execute arbitrary code within the content process of the affected application, leading to a complete compromise of the system’s confidentiality, integrity, and availability. This breach enables unauthorised access to sensitive user data and opens the door for further lateral movement within the network, particularly if the compromised system is part of a larger infrastructure. The urgency and potential impact are heightened by the fact that this vulnerability is actively being exploited in the wild, indicating that malicious actors are already aware of, and leveraging, this vulnerability.

Vulnerability Detection

Mozilla has released a security update addressing the security flaw in the respective product versions. As such, previous versions are vulnerable to potential exploits.

Exploitation

This vulnerability is actively being exploited in the wild, highlighting the urgency for users to update their systems. There is no evidence that a public proof-of-concept exists.

Containment, Mitigations & Remediations

It is highly recommended that all organisations run the relevant patches as soon as possible. The web browser vulnerability affects Firefox 131.0.2, Firefox ESR 128.3.1, and Firefox ESR 115.16.1. Users should upgrade to version 131.0.2 in Firefox and to versions 115.16.1 or 128.3.1 for Firefox ESR to fix the vulnerability.

If immediate patching is not feasible, consider temporarily disabling or restricting the use of Firefox until the update can be applied. Additionally, implement network segmentation and access controls to limit potential lateral movement in case of a compromise.

Threat Landscape

Mozilla Firefox’s prominence in the web browser market is well-recognised. The threat landscape surrounding the critical Firefox vulnerability (CVE-2024-9680) is both complex and severe, posing significant risks to users and organisations across various sectors.