Use after free in FileSystem in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-10931 Chrome version check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

VERSION_RE = re.compile(r'(\d+\.\d+\.\d+\.\d+)')
FIXED = {
    'Windows': (149, 0, 7827, 53),
    'Darwin':  (149, 0, 7827, 53),
    'Linux':   (149, 0, 7827, 53),
}


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.group(1).split('.'))


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=5)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        v = parse_version(out)
        if v:
            return v, out.strip(), ' '.join(cmd)
    except Exception:
        pass
    return None, None, None


def candidate_commands():
    system = platform.system()
    cmds = []

    if system == 'Windows':
        local = os.environ.get('LOCALAPPDATA', r'C:\Users\Default\AppData\Local')
        pf = os.environ.get('ProgramFiles', r'C:\Program Files')
        pfx86 = os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)')
        paths = [
            Path(local) / 'Google/Chrome/Application/chrome.exe',
            Path(pf) / 'Google/Chrome/Application/chrome.exe',
            Path(pfx86) / 'Google/Chrome/Application/chrome.exe',
            Path(local) / 'Chromium/Application/chrome.exe',
            Path(pf) / 'Chromium/Application/chrome.exe',
            Path(pfx86) / 'Chromium/Application/chrome.exe',
        ]
        for p in paths:
            cmds.append([str(p), '--version'])

    elif system == 'Darwin':
        paths = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            str(Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium'),
        ]
        for p in paths:
            cmds.append([p, '--version'])

    else:
        binaries = [
            'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome'
        ]
        for b in binaries:
            resolved = shutil.which(b)
            if resolved:
                cmds.append([resolved, '--version'])
        common_paths = [
            '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium', '/usr/bin/chromium-browser',
            '/opt/google/chrome/chrome'
        ]
        for p in common_paths:
            cmds.append([p, '--version'])

    return cmds


def main():
    system = platform.system()
    if system not in FIXED:
        print('UNKNOWN: unsupported OS for this check: {}'.format(system))
        sys.exit(2)

    fixed = FIXED[system]
    seen = []

    for cmd in candidate_commands():
        path = cmd[0]
        if not Path(path).exists() and not shutil.which(path):
            continue
        v, raw, used = run_version(cmd)
        if v:
            seen.append((v, raw, used))

    if not seen:
        print('UNKNOWN: Chrome/Chromium not found or version could not be determined')
        sys.exit(2)

    # Prefer highest discovered version if multiple installs exist.
    seen.sort(key=lambda x: x[0], reverse=True)
    version, raw, used = seen[0]

    print('Detected via: {}'.format(used))
    print('Reported version: {}'.format('.'.join(str(x) for x in version)))
    print('Raw output: {}'.format(raw))
    print('Fixed threshold for {}: {}'.format(system, '.'.join(str(x) for x in fixed)))

    if version < fixed:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()