Google Chrome V8 inappropriate implementation leading to renderer-sandbox code execution

#!/usr/bin/env python3
# chrome_cve_check.py
# Check whether the locally installed Google Chrome version is vulnerable to
# CVE-2026-10904 based on fixed versions discussed in Chrome 149 advisories.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys

FIXED_DEFAULT = (149, 0, 7827, 53)
FIXED_MAC = (149, 0, 7827, 54)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(binary):
    try:
        cp = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=10)
        out = (cp.stdout or '') + ' ' + (cp.stderr or '')
        return parse_version(out.strip())
    except Exception:
        return None


def candidate_paths():
    system = platform.system()
    paths = []

    if system == 'Windows':
        envs = [
            os.environ.get('ProgramFiles'),
            os.environ.get('ProgramFiles(x86)'),
            os.environ.get('LocalAppData'),
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe',
        ]
        for base in envs:
            if base:
                for suffix in suffixes:
                    paths.append(os.path.join(base, suffix))
    elif system == 'Darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            resolved = shutil.which(name)
            if resolved:
                paths.append(resolved)
        paths.extend([
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
        ])

    # De-duplicate while preserving order
    seen = set()
    ordered = []
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            ordered.append(p)
    return ordered


def main():
    ap = argparse.ArgumentParser(description='Check local Chrome version against CVE-2026-10904 fixed builds.')
    ap.add_argument('--path', help='Explicit path to Chrome binary/exe', default=None)
    args = ap.parse_args()

    system = platform.system()
    fixed = FIXED_MAC if system == 'Darwin' else FIXED_DEFAULT

    paths = [args.path] if args.path else candidate_paths()
    found_any = False

    for path in paths:
        if not path:
            continue
        if not os.path.exists(path) and not shutil.which(path):
            continue
        found_any = True
        version = run_version(path)
        if not version:
            continue

        if version < fixed:
            print(f'VULNERABLE - {path} version {".".join(map(str, version))} < fixed {".".join(map(str, fixed))}')
            sys.exit(1)
        else:
            print(f'PATCHED - {path} version {".".join(map(str, version))} >= fixed {".".join(map(str, fixed))}')
            sys.exit(0)

    if not found_any:
        print('UNKNOWN - Chrome binary not found in common locations')
    else:
        print('UNKNOWN - Chrome found but version could not be determined')
    sys.exit(2)


if __name__ == '__main__':
    main()