Mozilla Firefox and Thunderbird Animation Timelines Use-After-Free Remote Code Execution Vulnerability (CVE-2024-9680) Urgent Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-9680) is a Use-After-Free (UAF) flaw within the Animation Timelines component of Mozilla Firefox and Thunderbird. It occurs when the browser processes web animation timelines and fails to properly nullify or clear pointers to objects that have already been deallocated from memory. Consequently, an attacker can manipulate the memory layout to reuse the freed memory space, leading to control flow hijacking.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by hosting a malicious payload on a website or injecting it into a compromised legitimate site. When a victim visits the site, the malicious JavaScript triggers precise allocation and deallocation of animation timeline objects, corrupting the heap memory. The attacker then populates the freed memory with shellcode, executing arbitrary commands within the context of the browser's sandboxed content process.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat. Successful exploitation allows attackers to compromise endpoint systems without user interaction beyond visiting a webpage. This can serve as an initial entry point for lateral movement, ransomware deployment, and sensitive data exfiltration across the corporate network.