Firefox Zero-day (CVE-2024-9680)

[ThatBigDerp]

Recently Firefox patched the CVE-2024-9680 zero-day in the following versions:

• Firefox 131.0.2
• Firefox ESR 128.3.1
• Firefox ESR 115.16.1

Currently Mercury is based on Firefox 192.0.02 which means it's vulnerable. My suggestion is due to low update activity to switch to Firefox's ESR release due to their slower, but more stable release cycle also reducing the need for you to update Mercury, if not at least update the browser to the latest Firefox version with the vulnerabilities patched, because according to Mozilla the vulnerability is already being exploited.

[gz83]

We will update as quickly as possible, but the disclosed vulnerabilities do not immediately put your device at risk.

[ridwanpr]

It's been 1 month