Attackers are using this November 9, 2026 Critical severity

brotli flaw used in attacks

A flaw in brotli, part of macOS. Processing maliciously crafted input may lead to memory corruption. CISA lists it as actively exploited.

On a Mac

Every Mac still on an affected version. The fix comes with the macOS update.

The fix

• macOS 15.8.3, 26.7.3 and 27.2.1

Attacks

In CISA’s catalog of exploited flaws since October 27, 2026.

CVE

CVE-2026-111497

Sources

• support.apple.com
• support.apple.com
• support.apple.com
• cisa.gov

From the Briefing, updated 32 minutes ago.