Google Chrome V8 type confusion allowing arbitrary read/write via crafted HTML

#!/usr/bin/env python3
# check_cve_2025_6554.py
# Detect likely exposure to CVE-2025-6554 on local Chrome installs.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys


def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    return tuple(int(x) for x in m.groups()) if m else None


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version():
    # Prefer registry App Paths / BLBeacon if present
    reg_paths = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in reg_paths:
        out = run_cmd(cmd)
        v = parse_ver(out)
        if v:
            return v, out

    common = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in common:
        if os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_ver(out)
            if v:
                return v, out
    return None, ''


def get_macos_version():
    apps = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
        "/Applications/Chromium.app/Contents/MacOS/Chromium",
    ]
    for path in apps:
        if os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_ver(out)
            if v:
                return v, out
    return None, ''


def get_linux_version():
    bins = ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser", "chrome"]
    for b in bins:
        p = shutil.which(b)
        if p:
            out = run_cmd([p, "--version"])
            v = parse_ver(out)
            if v:
                return v, out
    return None, ''


def main():
    system = platform.system()
    version = None
    raw = ''
    fixed = None

    if system == 'Windows':
        version, raw = get_windows_version()
        fixed = (138, 0, 7204, 96)
    elif system == 'Darwin':
        version, raw = get_macos_version()
        fixed = (138, 0, 7204, 92)
    elif system == 'Linux':
        version, raw = get_linux_version()
        fixed = (138, 0, 7204, 92)
    else:
        print('UNKNOWN - unsupported platform:', system)
        sys.exit(2)

    if not version:
        print('UNKNOWN - Chrome/Chromium version not found')
        sys.exit(2)

    print(f'Detected version: {version[0]}.{version[1]}.{version[2]}.{version[3]}')
    print(f'Raw version output: {raw}')
    print(f'Fixed threshold for {system}: {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]}+')

    if cmp_ver(version, fixed) < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()