In October 2024, Russia-aligned RomCom used a Firefox zero-day to run code in a browser process, then a Windows zero-day to escape the browser’s security boundary and raise privileges. A victim who reached a page serving the exploit did not need to click again for the chain to run. Mozilla fixed the Firefox flaw on October 9, 2024; Microsoft’s Windows fix followed on November 12. Today, install the current updates offered for supported Firefox and Windows devices—the version numbers associated with the 2024 fixes are historical.
What happened in the RomCom attack?
ESET Research reported that RomCom’s exploit chain combined two vulnerabilities: CVE-2024-9680 in Firefox and CVE-2024-49039 in Windows. The first could execute code inside Firefox’s content process. The second could help an attacker escape the browser sandbox and gain higher privileges on Windows.
ESET described the delivery as beginning at a fake website that redirected a potential victim to a server hosting the exploit. If a vulnerable browser loaded the exploit page, the attack could proceed without further user interaction. ESET said it did not know how the link to the fake site was distributed, so the available reporting does not establish a single lure or explain how every victim reached it. Some exploit servers redirected visitors to legitimate sites afterward, apparently to avoid suspicion.
Successful exploitation led to downloading and executing the RomCom backdoor, according to ESET. That payload was not the only possible outcome of the vulnerabilities: Google Threat Intelligence Group (GTIG) later reported that another actor used the same exploits with a different payload while the Windows flaw was still a zero-day.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
What were CVE-2024-9680 and CVE-2024-49039?
| Vulnerability | Affected layer | Reported impact | Patch timing |
|---|---|---|---|
| CVE-2024-9680 | Firefox Animation timelines and the browser content process | Use-after-free that could allow code execution in the content process; Mozilla rated it critical and said it had been exploited in the wild. | Mozilla announced fixed Firefox releases on October 9, 2024. |
| CVE-2024-49039 | Windows privilege boundary, used after browser-process compromise | Privilege-escalation flaw. GTIG’s later analysis describes exploitation through a Windows Task Scheduler RPC interface, with a path from a low-integrity browser process toward SYSTEM privileges. | ESET says Microsoft released the fix on November 12, 2024, through KB5046612. |
Mozilla’s advisory confirms that the browser flaw was a use-after-free in Animation timelines and says attackers had achieved code execution in the content process. ESET assessed its severity as CVSS 9.8. The Windows issue served a different purpose: it could extend an initial browser compromise beyond the browser’s restricted environment.
What does “zero-click” mean in this case?
It means that after a vulnerable browser reached a page serving the exploit, no additional user action was required for exploitation, according to ESET. It does not mean the attack reached people without any route to the page: ESET documented a fake-site redirect but said it did not know how the fake-site link was distributed. The distinction matters because “zero-click” describes the exploit’s behavior after page load, not a fully established account of how victims were targeted.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Which browsers and devices were affected?
ESET reported that the Firefox vulnerability affected Firefox, Thunderbird, and Tor Browser. The second vulnerability was in Windows. The reporting describes a chained attack involving a vulnerable browser and Windows; it does not establish that every affected product or every visitor was successfully compromised.
GTIG independently found a weaponized Firefox and Tor exploit chain in early October 2024. It refers to the actor as CIGAR, publicly reported as RomCom, and assesses financially motivated activity alongside espionage likely conducted on behalf of the Russian government. GTIG also identified a likely financially motivated second actor using the same exploits with a different payload. These are GTIG’s assessments, rather than a claim that all use of the exploits had the same operator or objective.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
When were the vulnerabilities fixed?
- October 8, 2024: ESET says it discovered CVE-2024-9680 and reported it to Mozilla.
- October 9, 2024: Mozilla announced Firefox 131.0.2, Firefox ESR 128.3.1, and Firefox ESR 115.16.1 as fixed releases for CVE-2024-9680. ESET also records fixes for Thunderbird and Tor Browser.
- November 12, 2024: ESET says Microsoft released the Windows fix through KB5046612.
Those browser versions and the KB number identify the historical fixes; they are not recommendations to install an old release or a substitute for current servicing guidance.
What should Firefox and Windows users do now?
- Update Firefox: Open Firefox and select Menu > Help > About Firefox. Firefox checks for and downloads available updates; restart the browser when prompted. Use the current update offered for your supported installation, not just the October 2024 fixed version.
- Update Windows: Open Settings > Windows Update, select Check for updates, install available updates, and restart if requested. Keep Windows on a supported release and follow the update guidance offered for that device.
- Update related software: If you use Thunderbird or Tor Browser, install the current update offered by each supported product rather than relying on the 2024 release numbers.
As of October 4, 2026, Mozilla’s advisory index lists Firefox 157 among releases with security fixes announced September 29, 2026. Release availability and servicing can change by product and support channel, so use the update mechanism and current guidance for your installation.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
What is known about the campaign’s reach?
ESET observed potential visitors from October 10 through November 4, 2024, mostly in Europe and North America. Its observed potential-target counts ranged from one per country to as many as 250. These are vendor telemetry counts of potential targets, not confirmed infections or a total number of victims.
For broader context, GTIG tracked 75 zero-day vulnerabilities exploited in the wild and disclosed in 2024. It reported that 44%—33 vulnerabilities—affected enterprise technologies. Those figures describe GTIG’s tracking of the year’s zero-days, not the number of vulnerabilities or victims in this RomCom incident.
Recommended Free Tools
Quick Recap
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Sources
- ESET Research, RomCom exploits Firefox and Windows zero days in the wild, published November 26, 2024.
- Mozilla Foundation Security Advisory 2024-51, documenting CVE-2024-9680 and the fixed Firefox releases.
- Google Threat Intelligence Group analysis, published April 2025, covering the exploit chain and wider zero-day context.
- Mozilla security advisories, including the release index current as of October 4, 2026.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
