What breaks and who should care
If you run Mozilla Firefox or Thunderbird on any system, you are sitting on a flaw that can let an attacker run arbitrary code inside the browser’s content process. The vulnerability, catalogued as CVE-2024-9680, has a CVSS score of 9.8 – that is as high as it gets. It has been confirmed in the wild and is already being used by ransomware operators. Any user, any organisation, any server that offers a web‑based interface and relies on these products should treat this as an emergency.
We keep a daily-updated list of vulnerabilities CISA has confirmed as actively exploited, including remediation deadlines.
For a sysadmin waking up at 2 am because a scanner raised an alert, the question is simple: does the software you manage fall into the affected range, and can you patch it now? The answer is in the next sections.
Technical overview
The bug lives in the way Firefox and its ESR (Extended Support Release) handle animation timelines. When a web page creates an animation, the engine builds a timeline object that tracks the animation’s progress. Under certain conditions that object can be freed from memory while the rendering code still holds a reference to it. When the code later tries to use that reference, it reads or writes to memory that no longer belongs to the timeline – a classic use‑after‑free.
Use‑after‑free errors are a favourite of exploit writers because they give a reliable path to corrupt memory. In this case the corrupted memory is inside the content process, which runs the web page’s code in a sandbox. The sandbox is designed to stop a compromised page from touching the rest of the system, but the memory corruption can be combined with other bugs to break out of that sandbox. The end result is that an attacker who can get a victim to visit a malicious page can execute native code with the privileges of the user running the browser.
The exact chain that the public exploits use has not been disclosed in detail. What we do know is that the vulnerability is a use‑after‑free in animation timelines, that it can be triggered by crafted JavaScript or CSS, and that the exploit reliably reaches code execution. Because the vulnerability is in the rendering engine, it works across all platforms that Firefox supports – Windows, macOS, Linux, and the various flavours of Android that use the same engine.
Why it’s severe
Remote code execution is the highest‑impact class of vulnerability. Combine that with the fact that the bug is already being weaponised in ransomware campaigns, and you have a situation where an unpatched machine can be turned into a foothold for a broader attack. The CVSS vector reflects the ease of exploitation (network‑accessible), the high confidentiality impact (access to user data), and the high integrity impact (ability to run arbitrary binaries).
In practice this means an attacker does not need to convince a user to download a malicious executable. A simple link in an email, a compromised advertisement network, or a malicious page on a trusted domain can trigger the bug. Once the exploit runs, the ransomware can encrypt files, exfiltrate data, or use the compromised host as a stepping‑stone to other internal assets.
How to determine if you’re exposed
The first step is to check which version of Firefox or Thunderbird is installed on each host. The exact version string is printed by the programmes themselves; you do not need to remember any numbers – just compare what you see to the ranges listed in the table below.
Linux
- For Debian‑based systems run
dpkg -l | grep firefoxordpkg -l | grep thunderbird. - For Red Hat‑based systems run
rpm -qa | grep firefoxorrpm -qa | grep thunderbird.
Windows
- Open PowerShell and type
Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe" | Select-Object VersionInfo. - Do the same for
thunderbird.exeif it is installed.
macOS
- Run
/Applications/Firefox.app/Contents/MacOS/firefox --versionin Terminal. - Run
/Applications/Thunderbird.app/Contents/MacOS/thunderbird --versionfor Thunderbird.
Take the version string that each command returns and check it against the table below. If the version falls in any of the affected ranges, the host is vulnerable until the patched release is applied.
Mitigations and fixes
The definitive fix is to upgrade to the patched release for your branch. Mozilla has released a new build that contains the corrected code. As soon as the update appears in your distribution’s repository, apply it.
Package‑manager updates
- Debian/Ubuntu:
sudo apt update && sudo apt install firefox thunderbird - Fedora/RHEL/CentOS:
sudo dnf upgrade firefox thunderbird - openSUSE:
sudo zypper refresh && sudo zypper install -u firefox thunderbird - Arch Linux:
sudo pacman -Syu firefox thunderbird
Windows
- If you use the built‑in auto‑update, open Firefox, go to Menu → Help → About Firefox. The browser will check for updates and apply them automatically.
- For enterprise deployments, download the latest MSI from Mozilla’s site and push it with your standard software‑distribution tool.
macOS
- Open Firefox, select Firefox → About Firefox. The app will fetch the newest build and prompt for a restart.
- Alternatively, use
brew upgrade --cask firefox thunderbirdif you manage browsers with Homebrew.
If, for any reason, you cannot apply the update immediately, a temporary mitigation is to disable animation timelines. This removes the code path that the exploit uses, at the cost of breaking some advanced web animations.
To turn the feature off, open about:config in Firefox, accept the risk warning, and set the following preference to false:
layout.css.animation-timeline.enabled
The same preference exists in Thunderbird’s configuration UI. Disabling it stops the vulnerable code from being instantiated, dramatically lowering the chance of a successful exploit. Remember, this is a stop‑gap – you should still apply the full patch as soon as possible.
If a patch isn’t available
In rare cases a particular operating‑system repository may lag behind the upstream release. If you cannot obtain the patched build within the next few hours, consider the following actions:
- Temporarily block outbound HTTP/HTTPS traffic to untrusted domains on the affected hosts. Use a web‑proxy or firewall rule that only allows connections to known, vetted sites.
- Deploy application‑level sandboxing (e.g. AppArmor on Linux, Windows Defender Application Guard, or macOS Seatbelt) to limit what the browser can do if it is compromised.
- Switch to an alternative browser that is not affected, such as a recent Chromium‑based build, until Firefox can be updated.
- For Thunderbird, if the mail client is not essential on the compromised host, disable it or replace it with a web‑mail solution that runs in a sandboxed environment.
These measures buy you time, but they are not a substitute for the real fix. The vulnerability is already being used in ransomware attacks, so the window for safe operation is very narrow.
Next steps
1. Run the version‑checking commands on every machine you manage.
2. Compare the output to the table below. If any host is listed as vulnerable, schedule an immediate update.
3. Apply the update using the appropriate package manager or the built‑in auto‑update mechanism.
4. Verify the new version is installed by re‑running the version command.
5. If you had to use the mitigation flag, keep it enabled only until the patched build is confirmed on the host.
6. Monitor CISA’s Known Exploited Vulnerabilities catalog for any further guidance or changes in the threat landscape.
7. Document the incident in your change‑management system, noting the date of detection, the remediation steps taken, and any temporary mitigations applied.
By moving quickly, you close the door that attackers are already knocking on. The table below summarises the affected and fixed releases; use it as a reference when you audit your fleet.
Affected versions
Straight from the NVD record for CVE-2024-9680. If your build is inside one of these ranges, treat it as vulnerable.
| Product | Affected range | Fixed in |
|---|---|---|
firefox |
* up to 115.16.1 | 115.16.1 |
firefox |
* up to 131.0.2 | 131.0.2 |
firefox |
128.1.0 up to 128.3.1 | 128.3.1 |
thunderbird |
* up to 115.16.0 | 115.16.0 |
thunderbird |
128.0.1 up to 128.3.1 | 128.3.1 |
