Use after free in Viz in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_10918.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

FIXED = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, ...]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd: List[str]) -> Optional[str]:
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
        return (p.stdout or p.stderr).strip() or None
    except Exception:
        return None


def version_from_exe(path: str) -> Optional[Tuple[int, ...]]:
    out = run_cmd([path, '--version'])
    if out:
        return parse_version(out)
    return None


def windows_versions() -> List[Tuple[str, Tuple[int, ...]]]:
    found = []
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            v = version_from_exe(path)
            if v:
                found.append((path, v))

    # Registry fallback via PowerShell if executable probing fails
    if not found:
        ps = shutil.which('powershell') or shutil.which('pwsh')
        if ps:
            script = r"""
$paths = @(
 'HKLM:\SOFTWARE\Google\Chrome\BLBeacon',
 'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
 'HKCU:\SOFTWARE\Google\Chrome\BLBeacon'
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    $v = (Get-ItemProperty -Path $p -ErrorAction SilentlyContinue).version
    if ($v) { Write-Output $v }
  }
}
"""
            out = run_cmd([ps, '-NoProfile', '-Command', script])
            if out:
                for line in out.splitlines():
                    v = parse_version(line.strip())
                    if v:
                        found.append(('registry', v))
    return found


def mac_versions() -> List[Tuple[str, Tuple[int, ...]]]:
    found = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            v = version_from_exe(path)
            if v:
                found.append((path, v))
    return found


def linux_versions() -> List[Tuple[str, Tuple[int, ...]]]:
    found = []
    binaries = [
        'google-chrome',
        'google-chrome-stable',
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for b in binaries:
        path = shutil.which(b) if not b.startswith('/') else b
        if path and os.path.exists(path):
            v = version_from_exe(path)
            if v:
                found.append((path, v))
    return found


def compare(v: Tuple[int, ...], fixed: Tuple[int, ...]) -> int:
    # returns -1 if v < fixed, 0 if equal, 1 if v > fixed
    if v < fixed:
        return -1
    if v > fixed:
        return 1
    return 0


def main() -> int:
    system = platform.system().lower()
    installs: List[Tuple[str, Tuple[int, ...]]] = []

    if 'windows' in system:
        installs = windows_versions()
    elif 'darwin' in system or 'mac' in system:
        installs = mac_versions()
    elif 'linux' in system:
        installs = linux_versions()
    else:
        print('UNKNOWN - unsupported platform: {}'.format(platform.system()))
        return 2

    if not installs:
        print('UNKNOWN - Google Chrome not found in common install locations')
        return 2

    vulnerable = []
    patched = []

    for path, ver in installs:
        if compare(ver, FIXED) < 0:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    if vulnerable:
        details = '; '.join(['{}={}'.format(p, '.'.join(map(str, v))) for p, v in vulnerable])
        print('VULNERABLE - found Chrome build(s) older than 149.0.7827.53: {}'.format(details))
        return 1

    details = '; '.join(['{}={}'.format(p, '.'.join(map(str, v))) for p, v in patched])
    print('PATCHED - all discovered Chrome build(s) are >= 149.0.7827.53: {}'.format(details))
    return 0


if __name__ == '__main__':
    sys.exit(main())