Use after free in Chromoting in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_10893.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

PATCH_FLOOR = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_ver(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(ver: Tuple[int, int, int, int]) -> str:
    return '.'.join(str(x) for x in ver)


def run_version_cmd(path: str) -> Optional[Tuple[int, int, int, int]]:
    try:
        cp = subprocess.run([path, '--version'], capture_output=True, text=True, timeout=8)
        out = (cp.stdout or '') + ' ' + (cp.stderr or '')
        return parse_ver(out)
    except Exception:
        return None


def read_macos_plist(app_path: str) -> Optional[Tuple[int, int, int, int]]:
    plist = os.path.join(app_path, 'Contents', 'Info.plist') if app_path.endswith('.app') else None
    if not plist or not os.path.exists(plist):
        return None
    try:
        cp = subprocess.run(['defaults', 'read', plist, 'CFBundleShortVersionString'], capture_output=True, text=True, timeout=8)
        if cp.returncode == 0:
            return parse_ver(cp.stdout)
    except Exception:
        pass
    return None


def windows_candidates() -> List[str]:
    cands = []
    envs = [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
        r'Chromium\Application\chrome.exe',
        r'Microsoft\Edge\Application\msedge.exe'
    ]
    for base in envs:
        if not base:
            continue
        for s in suffixes:
            p = os.path.join(base, *s.split('\\'))
            if os.path.exists(p):
                cands.append(p)
    return cands


def macos_candidates() -> List[str]:
    return [
        '/Applications/Google Chrome.app',
        '/Applications/Chromium.app',
        '/Applications/Microsoft Edge.app'
    ]


def linux_candidates() -> List[str]:
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'microsoft-edge', 'microsoft-edge-stable']
    found = []
    for n in names:
        p = shutil.which(n)
        if p:
            found.append(p)
    return found


def detect_candidates(user_path: Optional[str]) -> List[str]:
    if user_path:
        return [user_path]
    system = platform.system().lower()
    if 'windows' in system:
        return windows_candidates()
    if 'darwin' in system:
        return macos_candidates()
    return linux_candidates()


def get_version(path: str) -> Optional[Tuple[int, int, int, int]]:
    if platform.system().lower() == 'darwin' and path.endswith('.app'):
        v = read_macos_plist(path)
        if v:
            return v
        path = os.path.join(path, 'Contents', 'MacOS', 'Google Chrome')
        if not os.path.exists(path):
            path = os.path.join(os.path.dirname(path), 'Chromium')
        if not os.path.exists(path):
            path = os.path.join(os.path.dirname(path), 'Microsoft Edge')
    return run_version_cmd(path)


def main() -> int:
    ap = argparse.ArgumentParser(description='Check local browser version against CVE-2026-10893 patch floor')
    ap.add_argument('--path', help='Exact browser binary or .app path to inspect')
    args = ap.parse_args()

    candidates = detect_candidates(args.path)
    if not candidates:
        print('UNKNOWN: no supported Chrome/Chromium/Edge executable found')
        return 2

    checked = []
    vulnerable = []
    patched = []

    for c in candidates:
        v = get_version(c)
        if v is None:
            checked.append(f'{c}=unknown')
            continue
        checked.append(f'{c}={ver_to_str(v)}')
        if v < PATCH_FLOOR:
            vulnerable.append((c, v))
        else:
            patched.append((c, v))

    if vulnerable:
        details = '; '.join(f'{p} -> {ver_to_str(v)}' for p, v in vulnerable)
        print(f'VULNERABLE: {details} (patch floor {ver_to_str(PATCH_FLOOR)})')
        return 1

    if patched:
        details = '; '.join(f'{p} -> {ver_to_str(v)}' for p, v in patched)
        print(f'PATCHED: {details} (patch floor {ver_to_str(PATCH_FLOOR)})')
        return 0

    print('UNKNOWN: unable to determine version from candidates: ' + '; '.join(checked))
    return 2


if __name__ == '__main__':
    sys.exit(main())