CVE-2024-9680 is a use-after-free vulnerability in the Animation timeline implementation of Mozilla Firefox and Thunderbird. Exploitation enables remote code execution within the content process, posing a critical security risk. The vulnerability affects versions of Firefox prior to 131.0.2 and ESR versions prior to 128.3.1 and 115.16.1, as well as corresponding Thunderbird versions. Mozilla has confirmed active exploitation in the wild and has released security updates to address the flaw.

Successful exploitation results in remote code execution in the content process, allowing an attacker to execute arbitrary code with the privileges of the browser process. This can lead to full compromise of the affected application and potentially the underlying system.

Mozilla has released official fixes for this vulnerability in Firefox 131.0.2, Firefox ESR 128.3.1, Firefox ESR 115.16.1, Thunderbird 131.0.1, Thunderbird 128.3.1, and Thunderbird 115.16.0. Users and administrators should update to these versions or later to mitigate the risk. No additional mitigation steps are required beyond applying the official patches.