CVE are assigned from the year the vulnerability was found. Not when it was announced.

However, a CNA like Firefox does not allocate CVE as they need them. They first ask Mitre for a block of X CVE to use as they need. They probably got a new block in September.