CVE-2024-9680Critical· 9.8▾ Hadal⚠ Exploited in the wild0dayPoC available

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score89/ 100 · Severe

impact 53.9 · likelihood 4.6 · exploitation 25 · ransomware 5

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Oct 9, 2024

Updated

Aug 4, 2026

CVSS

9.8

Vendor

mozilla

Product

firefox

CWE

CWE-416, CWE-416

Depth score

89 · Severe

EPSS

23% · p98

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

3 public repositories

EPSS history

Exploit-prediction probability, daily snapshots since Aug 4.

23% → 23%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 700 days

Oct 9, 2024Published
Disclosed via NVD
Oct 15, 2024Added to CISA KEV
Federal remediation due Nov 5, 2024
Aug 4, 2026Record revised
Last analysed / modified upstream
Aug 4, 2026EPSS first tracked
23%
Sep 8, 2026Public exploit observed
3 GitHub repos

mozilla CWE-416 CWE-416 #nvd #kev #in-the-wild #exploit-available

CISA KEVKnown Exploited VulnerabilityRansomware campaign use

Added to the CISA catalog on Oct 15, 2024. Federal remediation due Nov 5, 2024. View catalog ↗

Affected

firefox < 115.16.1
firefox < 131.0.2
firefox >= 128.1.0, < 128.3.1
thunderbird < 115.16.0
thunderbird >= 128.0.1, < 128.3.1
thunderbird = 131.0
debian_linux = 11.0

Patched in

firefox 128.3.1
thunderbird 128.3.1

Full technical detail▾

Overview

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Affected

firefox < 115.16.1
firefox < 131.0.2
firefox >= 128.1.0, < 128.3.1
thunderbird < 115.16.0
thunderbird >= 128.0.1, < 128.3.1
thunderbird = 131.0
debian_linux = 11.0

Remediation

Upgrade past the affected range:

firefox 128.3.1
thunderbird 128.3.1

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available

← Back to feed

CVE-2024-9680Critical· 9.8▾ Hadal⚠ Exploited in the wild0dayPoC available

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score89/ 100 · Severe

impact 53.9 · likelihood 4.6 · exploitation 25 · ransomware 5

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Oct 9, 2024

Updated

Aug 4, 2026

CVSS

9.8

Vendor

mozilla

Product

firefox

CWE

CWE-416, CWE-416

Depth score

89 · Severe

EPSS

23% · p98

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

3 public repositories

EPSS history

Exploit-prediction probability, daily snapshots since Aug 4.

23% → 23%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 700 days

Oct 9, 2024Published
Disclosed via NVD
Oct 15, 2024Added to CISA KEV
Federal remediation due Nov 5, 2024
Aug 4, 2026Record revised
Last analysed / modified upstream
Aug 4, 2026EPSS first tracked
23%
Sep 8, 2026Public exploit observed
3 GitHub repos

mozilla CWE-416 CWE-416 #nvd #kev #in-the-wild #exploit-available

CISA KEVKnown Exploited VulnerabilityRansomware campaign use

Added to the CISA catalog on Oct 15, 2024. Federal remediation due Nov 5, 2024. View catalog ↗

Affected

firefox < 115.16.1
firefox < 131.0.2
firefox >= 128.1.0, < 128.3.1
thunderbird < 115.16.0
thunderbird >= 128.0.1, < 128.3.1
thunderbird = 131.0
debian_linux = 11.0

Patched in

firefox 128.3.1
thunderbird 128.3.1

Full technical detail▾

Overview

Affected

firefox < 115.16.1
firefox < 131.0.2
firefox >= 128.1.0, < 128.3.1
thunderbird < 115.16.0
thunderbird >= 128.0.1, < 128.3.1
thunderbird = 131.0
debian_linux = 11.0

Remediation

Upgrade past the affected range:

firefox 128.3.1
thunderbird 128.3.1

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available