No matter who discovered it, there was a patch in late February. One can excuse them for describing the commit as something ordinary to avoid alerting the baddies (traditional "disclosure window" etc. stuff) but it's absurd to me that the corresponding releases, with no other code changes (per the commit history), took almost 8 months.

Exatly, it was patched silently, OpenaAI just discovered that patch, and that it has upstream effects in NodeJS etc.

[Edit: I was inattentive and replied twice in different ways, thinking they were to different parent comments; I've now merged my thoughts and edited them to be more coherent.]

> reported

This is Mozilla's own discussion of the issue, though. There's mention of

> https://github.com/google/brotli/blob/master/SECURITY.md suggests that it should go through Google's regular vulnerability reporting process. I don't have any more specific knowledge around this library, however.

but that doesn't establish that this was done.

If it was done, then I think we deserve answers about why it took Google almost 8 months to release a new version of a common dependency, applying a security patch (and no other changes!) when the vulnerability was known at least 6 months ago (and possibly the full 8 months ago) to cause RCE.

If I'm understanding the report correctly, the patch was applied in Firefox's vendored copy within days, and available in 151 and I guess some 150.0.x release. And also they were supposedly beaten to the punch:

> Probably we should update to cfa184a997ac19454d5a3ae97f6d600aac2445a6 which was rolled into chromium 2 weeks ago. If there are other recent sec fixes this would pick them up

It seems even more embarrassing if chromium got the patch but Chrome didn't. And if Chrome did, then it's that much more appalling not to see a patched separate release for so long.

(I was confused trying to go through the technical details, though: the "affected code" seems to have very little overlap with the code actually altered by the patch.)