Google Chrome Ozone use-after-free remote code execution

#!/usr/bin/env bash
# check_cve_2026_10902.sh
# Determine likely exposure to CVE-2026-10902 on Linux/ChromeOS Chrome-family browsers.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"
TARGET="${1:-}"

candidates=(
  "$TARGET"
  "/usr/bin/google-chrome"
  "/usr/bin/google-chrome-stable"
  "/usr/bin/chromium"
  "/usr/bin/chromium-browser"
  "/opt/google/chrome/chrome"
)

find_browser() {
  local c
  for c in "${candidates[@]}"; do
    [ -n "$c" ] || continue
    if [ -x "$c" ]; then
      echo "$c"
      return 0
    fi
  done
  return 1
}

normalize_version() {
  # Keep only first numeric dotted quad-like string.
  echo "$1" | grep -Eo '[0-9]+(\.[0-9]+){2,3}' | head -n1
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

BROWSER="$(find_browser)" || {
  echo "UNKNOWN - no Chrome/Chromium binary found in expected paths"
  exit 2
}

RAW_OUT="$($BROWSER --version 2>/dev/null || true)"
VERSION="$(normalize_version "$RAW_OUT")"

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not parse browser version from: $RAW_OUT"
  exit 2
fi

case "$(uname -s 2>/dev/null || echo unknown)" in
  Linux) : ;;
  *)
    echo "UNKNOWN - script logic is intended for Linux/ChromeOS style targets; detected $(uname -s 2>/dev/null || echo unknown)"
    exit 2
    ;;
esac

if ver_lt "$VERSION" "$FIXED_VERSION"; then
  echo "VULNERABLE - $BROWSER version $VERSION is older than fixed $FIXED_VERSION"
  exit 1
else
  echo "PATCHED - $BROWSER version $VERSION is at or above fixed $FIXED_VERSION"
  exit 0
fi