Use after free in Chrome for iOS in Google Chrome on iOS prior to 149

#!/usr/bin/env python3
# check_cve_2026_10896.py
# Assess Chrome for iOS versions against CVE-2026-10896.
# Outputs per-row status: VULNERABLE / PATCHED / UNKNOWN
# Exit codes:
#   0 = all parsed rows patched
#   1 = one or more vulnerable rows found
#   2 = only UNKNOWN rows or input/problem error

import csv
import re
import sys
from argparse import ArgumentParser

FIXED_VERSION = (149, 0, 7827, 53)
DEFAULT_COLUMNS = [
    'app_version', 'version', 'chrome_version', 'appversion',
    'Application Version', 'App Version', 'Chrome Version'
]
DEVICE_COLUMNS = [
    'device', 'device_name', 'Device Name', 'serial', 'Serial Number',
    'udid', 'UDID', 'user', 'User', 'owner', 'Owner'
]


def normalize_version(value):
    if value is None:
        return None
    text = str(value).strip()
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def compare_versions(a, b):
    return (a > b) - (a < b)


def pick_column(fieldnames, preferred=None, candidates=None):
    if preferred and preferred in fieldnames:
        return preferred
    if candidates:
        for c in candidates:
            if c in fieldnames:
                return c
    lowered = {f.lower(): f for f in fieldnames}
    if preferred and preferred.lower() in lowered:
        return lowered[preferred.lower()]
    if candidates:
        for c in candidates:
            if c.lower() in lowered:
                return lowered[c.lower()]
    return None


def main():
    parser = ArgumentParser(description='Check MDM-exported Chrome for iOS versions for CVE-2026-10896 exposure.')
    parser.add_argument('csvfile', help='Path to CSV exported from MDM/UEM')
    parser.add_argument('--version-column', help='Exact column name containing Chrome version')
    parser.add_argument('--device-column', help='Exact column name containing device identifier/name')
    args = parser.parse_args()

    try:
        with open(args.csvfile, 'r', encoding='utf-8-sig', newline='') as f:
            reader = csv.DictReader(f)
            if not reader.fieldnames:
                print('UNKNOWN: CSV has no header row', file=sys.stderr)
                sys.exit(2)

            version_col = pick_column(reader.fieldnames, args.version_column, DEFAULT_COLUMNS)
            device_col = pick_column(reader.fieldnames, args.device_column, DEVICE_COLUMNS)

            if not version_col:
                print('UNKNOWN: could not find a version column; use --version-column', file=sys.stderr)
                sys.exit(2)

            found_rows = 0
            vulnerable = 0
            patched = 0
            unknown = 0

            for idx, row in enumerate(reader, start=2):
                found_rows += 1
                device = row.get(device_col, '') if device_col else ''
                device = str(device).strip() if device else f'row_{idx}'
                raw_version = row.get(version_col)
                parsed = normalize_version(raw_version)

                if parsed is None:
                    print(f'{device},UNKNOWN,unparseable_version,{raw_version}')
                    unknown += 1
                    continue

                if compare_versions(parsed, FIXED_VERSION) < 0:
                    print(f'{device},VULNERABLE,{version_to_str(parsed)},fixed>={version_to_str(FIXED_VERSION)}')
                    vulnerable += 1
                else:
                    print(f'{device},PATCHED,{version_to_str(parsed)},fixed>={version_to_str(FIXED_VERSION)}')
                    patched += 1

            if found_rows == 0:
                print('UNKNOWN: CSV contains no data rows', file=sys.stderr)
                sys.exit(2)

            summary = f'SUMMARY vulnerable={vulnerable} patched={patched} unknown={unknown} fixed>={version_to_str(FIXED_VERSION)}'
            print(summary, file=sys.stderr)

            if vulnerable > 0:
                sys.exit(1)
            if patched > 0 and vulnerable == 0:
                sys.exit(0)
            sys.exit(2)

    except FileNotFoundError:
        print(f'UNKNOWN: file not found: {args.csvfile}', file=sys.stderr)
        sys.exit(2)
    except Exception as e:
        print(f'UNKNOWN: {e}', file=sys.stderr)
        sys.exit(2)


if __name__ == '__main__':
    main()