Comment on RomCom exploits Firefox and Windows zero days in the wild

Telorand@reddthat.com ⁨3⁩ ⁨weeks⁩ ago

Tldr:

  • Analysis of the exploit led to the discovery of the vulnerability, now assigned CVE-2024-9680: a use-after-free bug in the animation timeline feature in Firefox. Mozilla patched the vulnerability on October 9th, 2024.

  • Further analysis revealed another zero-day vulnerability in Windows: a privilege escalation bug, now assigned CVE‑2024‑49039, that allows code to run outside of Firefox’s sandbox. Microsoft released a patch for this second vulnerability on November 12th, 2024.

If you’re up to date on your security patches, you’re fine.

source
Sort:hotnewtop