Use after free in Cast in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_10926.py
# Detects whether Google Chrome is below the fixed version for CVE-2026-10926.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import plistlib
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v) if v else 'unknown'


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def check_linux():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
        ['/snap/bin/chromium', '--version'],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return (' '.join(cmd[:-1]), v)
    return (None, None)


def check_macos():
    plist_paths = [
        '/Applications/Google Chrome.app/Contents/Info.plist',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/Info.plist'),
        '/Applications/Chromium.app/Contents/Info.plist',
        os.path.expanduser('~/Applications/Chromium.app/Contents/Info.plist'),
    ]
    for path in plist_paths:
        try:
            if os.path.exists(path):
                with open(path, 'rb') as f:
                    data = plistlib.load(f)
                v = parse_version(data.get('KSVersion') or data.get('CFBundleShortVersionString') or '')
                if v:
                    return (path, v)
        except Exception:
            pass
    return (None, None)


def check_windows():
    reg_queries = [
        r'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        r'HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        r'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        r'HKLM\SOFTWARE\Google\Chrome\BLBeacon',
        r'HKCU\SOFTWARE\Google\Chrome\BLBeacon',
    ]

    for key in reg_queries:
        out = run_cmd(['reg', 'query', key])
        v = parse_version(out)
        if v:
            return (key, v)
        m = re.search(r'\s+REG_SZ\s+(.+chrome\.exe)\s*$', out, re.IGNORECASE | re.MULTILINE)
        if m:
            exe = m.group(1).strip()
            out2 = run_cmd([exe, '--version'])
            v2 = parse_version(out2)
            if v2:
                return (exe, v2)

    common_paths = [
        r'C:\Program Files\Google\Chrome\Application\chrome.exe',
        r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
        os.path.expandvars(r'%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in common_paths:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return (path, v)
    return (None, None)


def main():
    system = platform.system().lower()
    source = None
    found = None

    if system == 'linux':
        source, found = check_linux()
    elif system == 'darwin':
        source, found = check_macos()
    elif system == 'windows':
        source, found = check_windows()
    else:
        print(f'UNKNOWN: unsupported platform {platform.system()}')
        sys.exit(2)

    if not found:
        print('UNKNOWN: Chrome/Chromium version not found')
        sys.exit(2)

    if found < FIXED:
        print(f'VULNERABLE: found {version_str(found)} via {source}; fixed is {version_str(FIXED)} or newer')
        sys.exit(1)
    else:
        print(f'PATCHED: found {version_str(found)} via {source}; fixed floor is {version_str(FIXED)}')
        sys.exit(0)


if __name__ == '__main__':
    main()