Use after free in Compositing in Google Chrome prior to 137

#!/usr/bin/env python3
# CVE-2025-5063 Chrome/Chromium version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (137, 0, 7151, 55)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v)


def compare_version(v1, v2):
    return (v1 > v2) - (v1 < v2)


def try_run(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=8)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return None, ''


def detect_linux():
    results = []
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium', '--version'],
        ['chromium-browser', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
        ['/usr/bin/google-chrome', '--version'],
        ['/usr/bin/chromium', '--version'],
        ['/usr/bin/chromium-browser', '--version'],
    ]
    seen = set()
    for cmd in candidates:
        key = tuple(cmd)
        if key in seen:
            continue
        seen.add(key)
        rc, out = try_run(cmd)
        if rc is None:
            continue
        v = parse_version(out)
        if v:
            results.append((' '.join(cmd[:-1]), v, out))
    return results


def detect_macos():
    results = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        str(Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]
    for app in candidates:
        if not os.path.exists(app):
            continue
        rc, out = try_run([app, '--version'])
        if rc is None:
            continue
        v = parse_version(out)
        if v:
            results.append((app, v, out))
    return results


def detect_windows():
    results = []
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Chromium', 'Application', 'chrome.exe'),
    ]

    for exe in candidates:
        if exe and os.path.exists(exe):
            rc, out = try_run([exe, '--version'])
            v = parse_version(out)
            if v:
                results.append((exe, v, out))

    try:
        import winreg
        keys = [
            (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon', 'version'),
            (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon', 'version'),
            (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon', 'version'),
            (winreg.HKEY_CURRENT_USER, r'Software\Chromium\BLBeacon', 'version'),
            (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Chromium\BLBeacon', 'version'),
        ]
        for hive, path, name in keys:
            try:
                with winreg.OpenKey(hive, path) as k:
                    val, _ = winreg.QueryValueEx(k, name)
                    v = parse_version(str(val))
                    if v:
                        results.append((f'registry:{path}', v, str(val)))
            except Exception:
                pass
    except Exception:
        pass

    # de-duplicate by source/version pair
    deduped = []
    seen = set()
    for src, v, raw in results:
        key = (src, v)
        if key not in seen:
            seen.add(key)
            deduped.append((src, v, raw))
    return deduped


def main():
    system = platform.system().lower()
    if 'windows' in system:
        found = detect_windows()
    elif 'darwin' in system or 'mac' in system:
        found = detect_macos()
    else:
        found = detect_linux()

    if not found:
        print('UNKNOWN: No Chrome/Chromium installation detected or version could not be read')
        sys.exit(2)

    vulnerable = []
    patched = []
    for src, v, raw in found:
        if compare_version(v, FIXED) < 0:
            vulnerable.append((src, v, raw))
        else:
            patched.append((src, v, raw))

    if vulnerable:
        details = '; '.join(f'{src}={version_str(v)}' for src, v, _ in vulnerable)
        print(f'VULNERABLE: Found version(s) below {version_str(FIXED)} -> {details}')
        sys.exit(1)

    details = '; '.join(f'{src}={version_str(v)}' for src, v, _ in patched)
    print(f'PATCHED: All detected version(s) are >= {version_str(FIXED)} -> {details}')
    sys.exit(0)


if __name__ == '__main__':
    main()