Google Chrome for Windows ANGLE use-after-free with code execution inside the sandbox

# check-chrome-cve-2026-10913.ps1

# Purpose: Determine whether Google Chrome on Windows is vulnerable to CVE-2026-10913

# Logic: Versions earlier than 149.0.7827.53 are VULNERABLE

# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromeCandidates {
    $paths = @(
        "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$Env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$Env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rp in $regPaths) {
        $reg = Get-ItemProperty -Path $rp
        if ($reg -and $reg.'(default)') {
            $paths += $reg.'(default)'
        }
        elseif ($reg -and $reg.Path) {
            $paths += (Join-Path $reg.Path 'chrome.exe')
        }
    }

    $paths | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

function Get-FileVersionString($path) {
    try {
        return (Get-Item $path).VersionInfo.ProductVersion
    }
    catch {
        return $null
    }
}

$candidates = Get-ChromeCandidates
if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN: Google Chrome not found in standard locations.'
    exit 2
}

$results = @()
foreach ($chromePath in $candidates) {
    $verString = Get-FileVersionString $chromePath
    if (-not $verString) {
        $results += [pscustomobject]@{
            Path = $chromePath
            Version = $null
            State = 'UNKNOWN'
        }
        continue
    }

    try {
        $ver = [version]$verString
        $state = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
    }
    catch {
        $state = 'UNKNOWN'
    }

    $results += [pscustomobject]@{
        Path = $chromePath
        Version = $verString
        State = $state
    }
}

$results | ForEach-Object {
    Write-Output ("{0}: {1} ({2})" -f $_.State, $_.Path, ($_.Version ? $_.Version : 'version unreadable'))
}

if ($results.State -contains 'VULNERABLE') {
    exit 1
}
elseif ($results.State -contains 'PATCHED') {
    exit 0
}
else {
    exit 2
}