#mozilla

Analysis · May 20, 2026 · Colten Anderson

Content-process only is one bug short of game over

CVE-2024-9680 was a Firefox use-after-free that 'only' ran code in the sandboxed content process. RomCom paired it with a Windows sandbox escape and turned a single page visit into a backdoor. Mozilla shipped the fix in about 25 hours.