“An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.”
CVE-2024-9680 hits the standard release and both ESR branches, and Mozilla has reports of it being exploited in the wild. The fix is Firefox 131.0.2. The bug lives in the Web Animations API, a feature that exists so web pages can move things around. A use-after-free turned a cosmetic feature into code execution.