Use after free in WebAuthentication in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_10906.py
# Detect whether the local Google Chrome installation is vulnerable to CVE-2026-10906
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import plistlib
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(v):
    return '.'.join(str(x) for x in v) if v else 'unknown'


def is_vulnerable(v):
    return v is not None and v < FIXED


def candidates_windows():
    paths = []
    envs = [os.environ.get('PROGRAMFILES'), os.environ.get('PROGRAMFILES(X86)'), os.environ.get('LOCALAPPDATA')]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
        r'Chromium\Application\chrome.exe'
    ]
    for base in envs:
        if not base:
            continue
        for suf in suffixes:
            p = Path(base) / Path(suf)
            paths.append(p)
    return paths


def candidates_macos():
    return [
        Path('/Applications/Google Chrome.app'),
        Path.home() / 'Applications/Google Chrome.app',
        Path('/Applications/Chromium.app'),
        Path.home() / 'Applications/Chromium.app'
    ]


def candidates_linux_cmds():
    return [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version']
    ]


def get_windows_versions():
    found = []
    for p in candidates_windows():
        if p.exists():
            try:
                out = subprocess.check_output([str(p), '--version'], stderr=subprocess.STDOUT, text=True, timeout=5)
                v = parse_version(out)
                found.append((str(p), v))
            except Exception:
                found.append((str(p), None))
    return found


def get_macos_versions():
    found = []
    for app in candidates_macos():
        plist = app / 'Contents' / 'Info.plist'
        if plist.exists():
            try:
                with open(plist, 'rb') as f:
                    data = plistlib.load(f)
                v = parse_version(data.get('CFBundleShortVersionString', '') or data.get('CFBundleVersion', ''))
                found.append((str(app), v))
            except Exception:
                found.append((str(app), None))
    return found


def get_linux_versions():
    found = []
    for cmd in candidates_linux_cmds():
        try:
            out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=5)
            v = parse_version(out)
            found.append((' '.join(cmd[:-1]), v))
        except Exception:
            continue
    # de-duplicate by path/label
    uniq = []
    seen = set()
    for item in found:
        if item[0] not in seen:
            uniq.append(item)
            seen.add(item[0])
    return uniq


def main():
    system = platform.system().lower()
    if 'windows' in system:
        installs = get_windows_versions()
    elif 'darwin' in system:
        installs = get_macos_versions()
    elif 'linux' in system:
        installs = get_linux_versions()
    else:
        print('UNKNOWN')
        print('Unsupported platform:', platform.system())
        sys.exit(2)

    if not installs:
        print('UNKNOWN')
        print('No Chrome/Chromium installation found')
        sys.exit(2)

    vuln = []
    patched = []
    unknown = []

    for name, ver in installs:
        if ver is None:
            unknown.append((name, ver))
        elif is_vulnerable(ver):
            vuln.append((name, ver))
        else:
            patched.append((name, ver))

    for name, ver in installs:
        print(f'{name}: {ver_to_str(ver)}')
    print(f'Fixed threshold: {ver_to_str(FIXED)}')

    if vuln:
        print('VULNERABLE')
        sys.exit(1)
    if patched and not vuln:
        print('PATCHED')
        sys.exit(0)

    print('UNKNOWN')
    sys.exit(2)


if __name__ == '__main__':
    main()