Google Brotli before 1.0.10, 1.1.1 and 1.2.1 has a vulnerability
Original title: Google security advisory (AV26-1085)
Canada's Cyber Centre urges administrators to review Google's advisory and apply updates, without naming impact or a CVE.
The Canadian Centre for Cyber Security published advisory AV26-1085 on October 26, 2026, saying Google Brotli is affected by a vulnerability as of October 22. Affected ranges are 1.0.3 before v1.0.10, 1.1.0 before v1.1.1, and 1.2.0 before v1.2.1. The alert does not describe the flaw, name a CVE, or state whether it is exploited.
Unconfirmed: The alert does not state the vulnerability's impact, CVE identifier or exploitation status.
- The advisory serial number is AV26-1085, dated October 26, 2026.
- Named fixed releases are v1.0.10, v1.1.1 and v1.2.1.
- Readers are directed to Brotli release notes for the updates.
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 to before v1.0.10; 1.1.0 to before v1.1.1; 1.2.0 to before v1.2.1 | v1.0.10, v1.1.1, v1.2.1 |
- 1.Review the linked Google advisory and apply available Brotli updates.
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1085 Date: October 26, 2026 As of October 22, 2026, Google is affected by a vulnerability in the following product: Brotli Versions 1. 0. 3 to versions prior to v1.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.