SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
18 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-111497 · CVSS 9.2

Google Brotli: attackers can run their own code

AFFECTSGoogle BrotliNodejsPython-hyper BrotlicffiMicrosoft .NETDebian LinuxIstioAnthropic BunEnvoyproxy EnvoyTianocore Edk2Google Woff2DuckdbClickhouse

OFFICIAL NAME: Google Brotli Unchecked Return Value Vulnerability

WHAT IT IS · COMPUTERS, PHONES AND BROWSERSIt runs on staff computers, phones or browsers.

DO THIS FIRSTInstall the latest updates on every device, and turn on automatic updates. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 19 days old, so many systems are likely still unpatched. The severity score is critical (9.2). The exploit prediction score is 83%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. The confirmation is 15 days old. 12 products are affected.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 7 INDEPENDENT SOURCES

    CVE-2026-111497 discussed publicly (CIRCL sighting). CVE-2026-111497 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. CISA Vulnrichment marks CVE-2026-111497 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-111497 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 5 days after disclosure. CISA listed it 5 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Nov 10, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. OCT 21, 2026
    59 public GitHub repositories claim a proof of concept for CVE-2026-111497
  2. Attack activity. OCT 22, 2026
    CISA Vulnrichment marks CVE-2026-111497 as actively exploited
  3. OCT 23, 2026
    Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
  4. OCT 24, 2026
    Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
  5. OCT 26, 2026
    PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
  6. OCT 26, 2026
    Microsoft releases emergency .NET security fixes for Google Brotli bug
  7. Attack activity. OCT 26, 2026
    Google Brotli Unchecked Return Value Vulnerability
  8. OCT 26, 2026
    Experts temper emergency-level alarms over critical Brotli defect
  9. OCT 27, 2026
    Brotli bug reaches far beyond Node.js (CVE-2026-111497)
  10. OCT 27, 2026
    CVE-2026-111497 discussed publicly (CIRCL sighting) (190 reports, latest NOV 10)
  11. OCT 27, 2026
    Public proof of concept for CVE-2026-111497 (CIRCL sighting) (15 reports, latest NOV 9)
  12. OCT 27, 2026
    Google security advisory (AV26-1085) - Update 1

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-111497 discussed publicly (CIRCL sighting), NOV 10
  2. [2] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-111497 (CIRCL sighting), NOV 9
  3. [3] Help Net Security: Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up, NOV 2
  4. [4] Security Affairs: Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION, NOV 1
  5. [5] Canadian Centre for Cyber Security: AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497, OCT 28
  6. [6] Security Affairs: U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog, OCT 28
  7. [7] The Hacker News: Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges, OCT 27
  8. [8] Canadian Centre for Cyber Security: Google security advisory (AV26-1085) - Update 1, OCT 27
  9. [9] Help Net Security: Brotli bug reaches far beyond Node.js (CVE-2026-111497), OCT 27
  10. [10] CyberScoop: Experts temper emergency-level alarms over critical Brotli defect, OCT 26
  11. [11] CISA Known Exploited Vulnerabilities: Google Brotli Unchecked Return Value Vulnerability, OCT 26
  12. [12] The Register (security): Microsoft releases emergency .NET security fixes for Google Brotli bug, OCT 26
  13. [13] The Hacker News: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw, OCT 26
  14. [14] The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software, OCT 24
  15. [15] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-111497 as actively exploited, OCT 22
  16. [16] PoC-in-GitHub: 59 public GitHub repositories claim a proof of concept for CVE-2026-111497, OCT 21
  17. [17] CIRCL Vulnerability-Lookup sightings: 203 more reports
  18. [18] The Hacker News: 1 more reports