Google Chrome on Android ANGLE heap buffer overflow requiring prior renderer compromise

#!/usr/bin/env bash
# check_chrome_android.sh
# Determine whether Google Chrome on Android is patched for CVE-2026-10929.
# Practical fixed baseline: 149.0.7827.59 or later.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/environment error

set -u

PKG="com.android.chrome"
FIXED="149.0.7827.59"
SERIAL="${1:-${ADB_SERIAL:-}}"

fail() {
  echo "UNKNOWN: $1"
  exit 2
}

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN: adb not found in PATH"
  exit 3
fi

ADB=(adb)
if [ -n "$SERIAL" ]; then
  ADB+=( -s "$SERIAL" )
fi

if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  echo "UNKNOWN: adb device not available or not authorized"
  exit 2
fi

version="$(("${ADB[@]}" shell dumpsys package "$PKG" 2>/dev/null || true) | tr -d '\r' | sed -n 's/.*versionName=//p' | head -n 1)"

if [ -z "$version" ]; then
  version="$(("${ADB[@]}" shell cmd package resolve-activity --brief "$PKG" 2>/dev/null || true) | tr -d '\r' >/dev/null; ("${ADB[@]}" shell pm dump "$PKG" 2>/dev/null || true) | tr -d '\r' | sed -n 's/.*versionName=//p' | head -n 1)"
fi

if [ -z "$version" ]; then
  echo "UNKNOWN: package $PKG not found or version could not be read"
  exit 2
fi

normalize() {
  local IFS=.
  local parts=($1)
  printf "%d.%d.%d.%d\n" \
    "${parts[0]:-0}" "${parts[1]:-0}" "${parts[2]:-0}" "${parts[3]:-0}"
}

ver_lt() {
  local a b IFS=.
  read -r -a a <<<"$(normalize "$1")"
  read -r -a b <<<"$(normalize "$2")"
  for i in 0 1 2 3; do
    if [ "${a[$i]}" -lt "${b[$i]}" ]; then
      return 0
    elif [ "${a[$i]}" -gt "${b[$i]}" ]; then
      return 1
    fi
  done
  return 1
}

if ver_lt "$version" "$FIXED"; then
  echo "VULNERABLE: $PKG version $version is older than fixed baseline $FIXED"
  exit 1
else
  echo "PATCHED: $PKG version $version is at or above fixed baseline $FIXED"
  exit 0
fi