The Brotli Bug Is Being Exploited (CVE-2026-111497): Home User Checklist for Chrome, Discord, VS Code and More

A bug in Brotli, the compression code Google wrote so web pages arrive a bit smaller and a bit faster, is now on the US government’s list of flaws attackers are actually using. You have never installed Brotli on purpose, and that is exactly the problem: it hides inside your browser, your chat apps, your developer tools and half of Linux.

The good news is that for most people this is a fifteen minute job with a cup of tea. Below is the home user checklist I wish the advisories had written: what carries Brotli, how to see if your copy is fixed, and the exact update steps on Windows, macOS, Linux and Android.

What actually went wrong

Brotli is everywhere because the web runs on it. When your browser fetches a page, the server often squashes it with Brotli and your browser unsquashes it. The unsquashing part, the decoder, is where the bug lives. As Tanium and other security firms explain it, the decoder treated one kind of broken input as “please send more data” instead of “this is rubbish”, kept going, and wrote past the end of a tiny internal buffer. Depending on what gets trampled, you get a crash, a peek at the app’s memory, or in the worst case attacker code running inside that app.

The attack can come from either direction. A server can be hit by a crafted upload, and an app on your computer can be hit by a crafted reply from a malicious website or server it talks to. That second route is why this is a home user story and not just a headache for people who own server racks.

The fix itself was committed to Brotli’s source code back on 27 February, according to Tanium’s timeline, and then sat there for eight months without anyone calling it a security fix. Google published fixed releases 1.0.10, 1.1.1 and 1.2.1 on 21 October 2026 at 19:27 UTC, which was 8:27pm in London, 3:27pm in New York, 12:27pm in Los Angeles and 4:27am the next morning in Tokyo. Node.js shipped its own fixes the same day.

The bug has collected more nicknames than a footballer: Node2Shell, HTTP2Shell, Brotli2Shell and, my personal favourite, Broccoli2Shell. After Plex2Shell earlier this month, I am starting to think “2Shell” is the security industry’s version of adding “Pro Max” to a phone.

What CISA actually said

CISA’s catalogue entry calls it the “Google Brotli Unchecked Return Value Vulnerability”, added on 27 October 2026, due 10 November 2026. Known ransomware use is listed as “Unknown”. That deadline legally applies to US federal agencies, but it is a decent hint for everyone else: if the US government has given its own departments two weeks, your laptop does not need a month.

Microsoft’s security team followed on 30 October with a “Patch now” post that lumps Brotli together with PHP2Shell and the eMudhra certificate mess. Its list of products carrying Brotli includes Node.js, .NET, PowerShell 7, Visual Studio, PHP’s Windows builds, Git for Windows, Python packages, Linux distributions, and says Chromium and Electron are both impacted too. Microsoft’s post also says these components are “built into software across the internet”, which is the most honest description of open source supply chains I have read all year.

Who needs to do what

Browsers: the five minute bit

Google’s release notes do not name this CVE, so I am not going to pretend I know exactly which Chrome build first fixed it. Tanium’s researchers report that Chrome has carried the upstream fix since version 148 in May, and that Edge and WebView2 148 or later should have it too, but that is their inference, not a Google statement. Microsoft, meanwhile, lists Chromium as impacted. The answer that works whichever of them is right: be on the latest version and restart.

1. Chrome: open chrome://settings/help, let it check, then click Relaunch. Version 156.0.8078.79 or later on Windows, Mac and Linux is the current stable release as I write this.
2. Edge: open edge://settings/help and relaunch when it finishes.
3. Firefox: Menu, Help, About Firefox, then Restart to update.
4. Brave, Opera, Vivaldi: each has an About page in its menu that checks for updates. Same routine.

The restart matters. A browser that “updated” three days ago but still has 47 tabs open from last Tuesday is running the old code. I know you are attached to those tabs. They will come back.

Discord, Slack, VS Code and other Electron apps

Electron apps are basically a private copy of Chrome wearing a different jacket, so each one brings its own Brotli and needs its own update. Tanium reports that apps built on Electron 42 or later already carry the fix through Chromium 148, while apps on Electron 41 or older need an update from whoever makes them. I could not find a statement from the Electron project itself, so treat the version numbers as a guide and the update button as the rule.

• Discord: fully quit it from the system tray or menu bar (closing the window just hides it), then reopen. It checks for updates on launch.
• Slack: on Windows and Mac, click your workspace menu or the Help menu and choose Check for Updates if it is offered. The Microsoft Store and Mac App Store versions update through their stores.
• VS Code: Help, Check for Updates on Windows and Linux; Code, Check for Updates on a Mac. If you use Remote SSH, WSL or tunnels, the server side updates too, and Tanium reports VS Code Server 1.143.1 bundles the fixed Node.js 24.22.1.
• Everything else built on Electron (Notion, Obsidian and plenty more): open the app’s About or Settings page and update. If an app has not had an update since spring, that is worth a raised eyebrow.

Windows step by step

1. Let Microsoft update its own extras. Microsoft says Windows Update does not deliver the .NET and PowerShell 7 fixes unless you opt in to updates for other Microsoft products. On Windows 11 that is Settings, Windows Update, Advanced options, Receive updates for other Microsoft products. Turn it on, then Check for updates.
2. Check what you have. Open Terminal and try node -v, pwsh -v, git version and dotnet --list-runtimes. “Not recognised” means you do not have it, which is the best possible result.
3. Update with winget if anything is old: winget upgrade Microsoft.PowerShell, winget upgrade Git.Git, and winget upgrade OpenJS.NodeJS.LTS for Node.js. Or simply winget upgrade to see the whole list first.
4. Visual Studio: Microsoft released fixes on 30 October 2026. Open the Visual Studio Installer and click Update.
5. Restart the PC. Microsoft itself warns these out-of-band fixes need an extra restart.

If you are still on Windows 11 24H2 Home or Pro, check my 24H2 end of updates checklist too, because no amount of app patching fixes a PC that has stopped getting Windows updates.

macOS step by step

1. Update browsers and Electron apps as above. App Store apps update in the App Store, Updates.
2. If you use Homebrew, open Terminal and run brew update then brew upgrade. brew list shows whether brotli or node is installed.
3. If you installed Node.js from nodejs.org or with nvm, run node -v and update to 22.23.4, 24.22.1 or 26.12.1 or later.

Linux step by step

1. Ubuntu, Debian, Mint, Pop!_OS: sudo apt update then sudo apt upgrade. Ubuntu’s security page lists fixed brotli packages for 26.10, 26.04, 24.04 and 22.04, with 20.04 and older covered through Ubuntu Pro.
2. Fedora: sudo dnf upgrade. Arch: sudo pacman -Syu. Check your distro’s security tracker for CVE-2026-111497 if you want to see the fixed package name.
3. Reboot. Apps that loaded the old libbrotli keep using it in memory until they restart, and a reboot is the lazy, reliable way to restart all of them.
4. Do not panic if the package version still says 1.0.9 or 1.1.0. Distros often patch the old version and add a suffix, so compare the full package name with the security notice, not the headline number.

Android step by step

1. Open the Play Store, tap your profile picture, Manage apps and device, then update Chrome and Android System WebView. WebView is the bit of Chromium other apps use to show web pages. Chrome for Android 156.0.8078.79 started rolling out on 29 October 2026.
2. Update other browsers you use (Samsung Internet, Brave, Firefox) from their store pages.
3. Android TV and Google TV boxes: same idea. Settings, Apps, or the Play Store’s My apps, and update Chrome or WebView if they are listed.

If you write a bit of code

• Node.js: check node -v, not process.versions.brotli. Tanium points out that fixed Node.js builds still report the old Brotli number there, which is the kind of small print that makes you want to lie down.
• Python: python3 -m pip show brotli brotlicffi. If either shows up below 1.2.1 (or 1.2.1.0 for brotlicffi), run python3 -m pip install -U brotli brotlicffi in that environment. Every virtual environment has its own copy, sadly.
• PowerShell 7 scripts: Microsoft notes that Invoke-WebRequest and Invoke-RestMethod decompress responses automatically, so a script pulling from a dodgy server is exactly the outbound route this bug likes.
• Docker images: pull fresh base images and rebuild. An old image is an old Brotli, frozen in amber.

Two traps to avoid

Fake “Brotli checker” tools. Every headline bug spawns GitHub repos promising a free scanner or proof of concept, and Tanium warns some of these carry malware. You do not need one. The version checks above are the scanner.

Thinking a VPN or antivirus covers it. They do not. The fix is the update.

PHP2Shell and eMudhra, briefly

Microsoft’s same post covers two neighbours. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of PHP flaws CISA listed as exploited on 26 October; it matters if you run a website, so if you have a WordPress site on cheap hosting, ask your host whether they are on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The eMudhra story is about eight weakly generated certificate authority keys; Microsoft removed the affected certificates through an out-of-band Windows update on 26 October and from Edge on 27 October, so keeping Windows and your browser updated is the home user fix.

A quick word on VPNs

A VPN will not patch Brotli, and anyone selling you one as a cure for this bug deserves a stern look. What a VPN does is encrypt your connection on hotel, airport and café Wi-Fi so the network you are borrowing sees less of what you do. If you want one, these are the ones I link to: NordVPN, Surfshark, IPVanish, CyberGhost, PureVPN and Ivacy, compared side by side in my VPN comparison. And if this week has you tidying up security generally, a password manager such as NordPass plus my advice on not using Sign in with Google for important accounts will do more for you than any nickname ending in “2Shell”.

Update (31 October 2026): what to watch next. CISA’s federal deadline is 10 November 2026. Microsoft says its CVE page is updated as more affected products are found, and it names DuckDB, Apache Arrow, p7zip and woff2 as places Brotli can hide. Watch for Electron app vendors shipping updates, Linux distros that were still catching up, and any detail on who is exploiting it. I will add dated updates here as those land.

Sources: Microsoft Security Response Center, “Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers” (30 October 2026); NVD entry for CVE-2026-111497; CISA Known Exploited Vulnerabilities catalogue; Google Brotli 1.2.1 release; Git for Windows 2.56.0(4) release notes; Chrome Releases blog (29 October 2026); Ubuntu CVE tracker; Tanium, “HTTP2Shell: Find and Fix Vulnerable Brotli Copies”. Images: screenshots of the Brotli 1.2.1 GitHub release page and the CISA catalogue entry, captured 31 October 2026.

Once your laptop is patched, the telly is next on the list. If your streaming box is so old it no longer gets Chrome or WebView updates, that is a sign it is time to retire it. The certified Google TV and Android TV boxes on this list get Play Store updates; the Formuler at the end is an IPTV player box, which is a different job entirely.

Best IPTV boxes to buy

These are media boxes and sticks that can run players and licensed apps. The first six are Google certified Android TV or Google TV devices with Google Play; the last one, the Formuler, runs its own Android and is not certified. They are not pirate hardware. They do not come with channels or playlists. I am not claiming I personally lab-tested every SKU this month.

Buy one of these when: Fire TV sideload is a hassle on your model, you want Play Store apps on a proper TV OS, or you want a dedicated player shell behind the sofa. No Fire TV device is on this shortlist.

• NVIDIA SHIELD TV Pro: the premium pick, a certified Android TV player with AI upscaling, Dolby Vision/Atmos and Gigabit Ethernet for the main living-room telly. Amazon UK | Amazon US | Amazon DE | Amazon FR | Amazon IT
• Google TV Streamer 4K: solid Google TV living-room default with Ethernet, 32GB storage and Dolby Vision/Atmos. Amazon UK | Amazon US | Amazon DE | Amazon FR | Amazon IT
• Xiaomi TV Box S (3rd Gen): Google TV box with 32GB storage, Wi-Fi 6 and Dolby Vision/Atmos, the cheaper box route than the Streamer. Amazon UK | Amazon US | Amazon DE | Amazon FR | Amazon IT
• Xiaomi TV Stick 4K (2nd Gen): budget Google TV stick with Wi-Fi 6 and Dolby Vision/Atmos when you want HDMI-simple, not a full box. Amazon UK | Amazon US | Amazon DE | Amazon FR | Amazon IT
• Budget Google TV 4K player: a cheaper certified Google TV player for a second telly. The model differs by store, so each link names the one you get there. MECOOL KD3 (Amazon UK) | onn. Google TV 4K Streaming Box (Amazon US) | Strong LEAP-NOVA-X (Amazon DE) | Strong LEAP-NOVA-X (Amazon FR) | Strong LEAP-NOVA-X (Amazon IT)
• MECOOL MEon1: Google TV certified 4K box with AI upscaling and 32GB storage for a dedicated player behind the sofa. Amazon UK
• Formuler Z12 Ultra SE: the newest Formuler box, built around MYTVOnline 4 for IPTV playlists. It runs Formuler’s own Android rather than certified Google TV, so there is no Netflix in HD and it is the one box here without Google certification. Formuler Z12 Ultra SE (Amazon UK) | Formuler Z12 Ultra SE (Amazon US) | Formuler Z12 Ultra SE (Amazon DE) | Formuler Z12 Ultra SE (Amazon FR) | Formuler Z12 Ultra SE (Amazon IT)

Still shopping for a Fire TV device? Fine for Prime Video and the Appstore universe. Not the shortlist above. And none of these boxes magically make unlicensed streams legal.

So, be honest: how many of these did you have installed without knowing Brotli was hiding inside? Tell me in the comments.

Written by Dr Husham Memar