Our automated tracking framework flagged that CISA added CVE-2026-111497 (Google Brotli) to the Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-111497 by November 10, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-111497 |
| Vendor / product | Google Brotli |
| Vulnerability | Google Brotli Unchecked Return Value Vulnerability |
| CVSS base score | — |
| Added to KEV | October 27, 2026 |
| Days public before listing (NVD → KEV lag) | 5 |
| Federal patch deadline | November 10, 2026 |
| Known ransomware use | No |
How This Compares to Google’s Track Record
This one was public for just 5 days before CISA confirmed exploitation — faster than Google’s 6-day median, meaning attackers moved unusually quickly.
| Google in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 76 |
| Median lag (public → KEV listing) | 6 days |
| 0-day rate (exploited at or before disclosure) | 24% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1765 tracked KEV entries is 232 days — Google’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Google KEV Additions
The most recent Google vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-58704 | Pixel | September 16, 2026 | 1 | No |
| CVE-2026-87491 | Chromium V8 | September 9, 2026 | 0 | No |
| CVE-2026-85046 | Chromium V8 | September 4, 2026 | 1 | No |
| CVE-2026-11645 | Chromium V8 | June 9, 2026 | 0 | No |
| CVE-2026-5281 | Dawn | April 1, 2026 | 0 | No |
Defense guide: How to Detect DDoS Attack: Warning Signs & Defense Playbook — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-111497, an Unchecked Return Value Vulnerability in Google Brotli, to its Known Exploited Vulnerabilities (KEV) catalog. This addition on October 27, 2026, means there’s active exploitation, so immediate attention is necessary. Federal agencies must apply patches by November 10, 2026, but all organizations using Google Brotli should prioritize patching to mitigate exposure. There’s no known ransomware use for this CVE.
The vulnerability was public for only 5 days before CISA added it to the KEV catalog. This short NVD-to-KEV lag suggests exploitation began very quickly after public disclosure, leaving little time for detection and remediation. Organizations that haven’t yet patched should assume potential compromise. Patch before the federal deadline; if you can’t, restrict access to services using Brotli and implement enhanced monitoring for unusual activity.
Related Coverage
- Google’s CVE-2026-85046 Was Exploited in 1 Days — Faster Than Its 7-Day Median (September 2026)
- Google’s CVE-2026-58704 Was Exploited in 1 Days — Faster Than Its 7-Day Median (September 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
