--- title: Critical Firefox Zero-Day Exploited: Immediate Update... description: Mozilla has disclosed a critical security flaw in Firefox, identified as CVE-2024-9680, which allows attackers to execute arbitrary code. The vulnerability is... canonical: https://daily.dev/posts/critical-firefox-zero-day-exploited-immediate-update-required-9vxu64ul1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Firefox Zero-Day Exploited: Immediate Update Required | daily.dev og:description: Mozilla has disclosed a critical security flaw in Firefox, identified as CVE-2024-9680, which allows attackers to execute arbitrary code. The vulnerability is... og:url: https://daily.dev/posts/critical-firefox-zero-day-exploited-immediate-update-required-9vxu64ul1 og:image: https://api.daily.dev/og/posts/9vxU64uL1.png og:image:alt: Critical Firefox Zero-Day Exploited: Immediate Update Required og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Firefox Zero-Day Exploited: Immediate Update Required **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 1 comments ## Summary Mozilla has disclosed a critical security flaw in Firefox, identified as CVE-2024-9680, which allows attackers to execute arbitrary code. The vulnerability is actively being exploited in the wild. Users are strongly advised to update to Firefox version 131.0.2 or Firefox ESR versions 115.16.1 or 128.3.1 to mitigate potential risks. Keeping browsers updated is essential for maintaining security. ## Content # Critical Security Update Issued for Mozilla Firefox Zero-Day Vulnerability CVE-2024-9680 Mozilla has disclosed a critical security flaw in its web browser, Firefox, and its Extended Support Release (ESR) versions. The vulnerability, identified as CVE-2024-9680, is a use-after-free bug in the Animation timeline component of the Web Animations API that could potentially allow attackers to execute arbitrary code. This flaw has been reported by Damien Schaeffer, a researcher from ESET, and is currently being actively exploited in the wild. ## The Vulnerability The CVE-2024-9680 flaw arises from a use-after-free issue in the Animation timeline component. By exploiting this vulnerability, attackers can execute arbitrary code by manipulating freed memory, posing a significant risk to users. ## Urgent Update Required Mozilla has released an emergency security update to address this critical issue. Users are strongly advised to update their browsers immediately to mitigate any potential risks. The required versions to patch this vulnerability are: * **Firefox**: Update to version 131.0.2 * **Firefox ESR**: Update to versions 115.16.1 or 128.3.1 To update Firefox, users can navigate to the update tool by selecting `Help -> About Firefox` in the settings menu. The browser will check for updates and install the latest version to ensure protection against this security flaw. ## Importance of Keeping Browsers Updated Administrators and users alike are urged to maintain updated browser versions as a key step toward a resilient security posture. This zero-day vulnerability underscores the critical nature of timely updates to safeguard against potential threats. Stay informed and stay secure by ensuring your Mozilla Firefox browser is up-to-date. ## Community discussion Top comments from developers on daily.dev. **@ghost** · 0 upvotes > Yeah, yeah, I'm updating. > > I JUST updated to my browser last month, and now I have to update it again. > > Stupid unsafe buf very fast native languages. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability), [#firefox](https://daily.dev/tags/firefox) [View this post on daily.dev](https://daily.dev/posts/critical-firefox-zero-day-exploited-immediate-update-required-9vxu64ul1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Firefox Zero-Day Exploited: Immediate Update Required","url":"https://daily.dev/posts/critical-firefox-zero-day-exploited-immediate-update-required-9vxu64ul1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-firefox-zero-day-exploited-immediate-update-required-9vxu64ul1"},"datePublished":"2024-10-10T09:38:05.750Z","dateModified":"2024-10-11T22:37:09.714Z","description":"Mozilla has disclosed a critical security flaw in Firefox, identified as CVE-2024-9680, which allows attackers to execute arbitrary code. The vulnerability is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2167838d027a704cee9f65e1e80965ba?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2167838d027a704cee9f65e1e80965ba?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/critical-firefox-zero-day-exploited-immediate-update-required-9vxu64ul1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,cyber,vulnerability,firefox","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Critical Firefox Zero-Day Exploited: Immediate Update Required"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/critical-firefox-zero-day-exploited-immediate-update-required-9vxu64ul1","comment":[{"@type":"Comment","text":"Yeah, yeah, I’m updating.\nI JUST updated to my browser last month, and now I have to update it again.\nStupid unsafe buf very fast native languages.","datePublished":"2024-10-17T10:51:33.906Z","url":"https://daily.dev/posts/9vxU64uL1#c-qdl3GiwiA","author":{"@type":"Person","name":"Deleted user","url":"https://daily.dev/ghost","image":"https://media.daily.dev/image/upload/s--hNIUzLiO--/f_auto/v1705327420/public/ghost_vlftth"}}]} ```