A vulnerability in Google's Brotli data-compression library could let hackers take control of vulnerable systems, crash applications or potentially access sensitive information. Because Brotli is built into widely used software and cloud services, the flaw could affect websites and apps people use every day, potentially disrupting services or putting data at risk.
The vulnerability, tracked as CVE-2026-111497, affects software that uses Brotli to decompress data. Google committed a fix to its source repository in February 2026 but did not issue a formal release containing the correction until 21 October.
