A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being actively exploited in cyberattacks.
With a CVSS base score of 9.8, the flaw is identified as Use-after-free in the Animation timeline component tracked as CVE-2024-9680 reported by Damien Schaeffer from ESET.“
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines”, reads the security advisory.“
We have had reports of this vulnerability being exploited in the wild”.
A use-after-free (UAF) vulnerability occurs when a program continues to access a previously released memory region. Unexpected behavior, crashes, or even security flaws like privilege escalation or remote code execution may result from this.
Analyse Any Suspicious Links Using ANY.RUN’s New Safe Browsing Tool: Try for Free
This flaw makes it possible for an attacker to execute arbitrary code inside the affected system, jeopardizing its availability, confidentiality, and integrity.
Moreover, this can result in further lateral network movement and illegal access to confidential user data.
As of right now, no information is available regarding how the vulnerability is being used in actual attacks.
The following browser versions have addressed this issue:
Users are urged to act right now and apply the patch as soon as feasible due to the critical severity of this vulnerability and its ongoing exploitation.
Strategies to Protect Websites & APIs from Malware Attack => Free Webinar
Google, in collaboration with its Mandiant Threat Intelligence team, has issued a warning about a…
The TgToxic Android malware, initially discovered in July 2022, has undergone significant updates, enhancing its…
A critical remote code execution (RCE) vulnerability, CVE-2023-20118, affecting Cisco Small Business Routers, has become…
The Socket Research Team has uncovered a malicious npm package@ton-wallet/create designed to steal sensitive cryptocurrency…
Researchers at Palo Alto Networks have identified a new Linux malware, dubbed "Auto-Color," that has…
The Lumma Stealer malware, a sophisticated infostealer, is being actively distributed through malicious files disguised…