Inappropriate implementation in Passwords in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_10937.py
# Determine whether installed Google Chrome is vulnerable to CVE-2026-10937
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import subprocess
import sys
from shutil import which

WIN_MIN = (149, 0, 7827, 53)  # .53 or later on Windows/macOS is accepted here; Google also shipped .54
MAC_MIN = (149, 0, 7827, 53)
LINUX_MIN = (149, 0, 7827, 53)

VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v) if v else 'unknown'


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def compare_versions(found, minimum):
    if found is None:
        return None
    return found >= minimum


def detect_windows(path_hint=None):
    candidates = []
    if path_hint:
        candidates.append(path_hint)
    local = os.environ.get('LOCALAPPDATA', '')
    prog = os.environ.get('ProgramFiles', '')
    progx86 = os.environ.get('ProgramFiles(x86)', '')
    candidates.extend([
        os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(prog, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(progx86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ])

    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return path, ver

    reg_queries = [
        [
            'reg', 'query',
            r'HKCU\Software\Google\Chrome\BLBeacon',
            '/v', 'version'
        ],
        [
            'reg', 'query',
            r'HKLM\Software\Google\Chrome\BLBeacon',
            '/v', 'version'
        ],
        [
            'reg', 'query',
            r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
            '/v', 'version'
        ]
    ]
    for cmd in reg_queries:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return 'registry', ver

    return None, None


def detect_macos(path_hint=None):
    candidates = []
    if path_hint:
        candidates.append(path_hint)
    candidates.extend([
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ])
    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return path, ver

    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        out = run_cmd(['/usr/bin/defaults', 'read', plist, 'KSVersion'])
        ver = parse_version(out)
        if ver:
            return plist, ver

    return None, None


def detect_linux(path_hint=None):
    candidates = []
    if path_hint:
        candidates.append(path_hint)
    for name in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']:
        p = which(name)
        if p:
            candidates.append(p)
    candidates.extend([
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ])
    seen = set()
    for path in candidates:
        if not path or path in seen:
            continue
        seen.add(path)
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return path, ver
    return None, None


def main():
    parser = argparse.ArgumentParser(description='Check Google Chrome for CVE-2026-10937 exposure by version.')
    parser.add_argument('--path', help='Explicit path to browser binary', default=None)
    args = parser.parse_args()

    system = platform.system().lower()

    if system == 'windows':
        source, ver = detect_windows(args.path)
        minimum = WIN_MIN
    elif system == 'darwin':
        source, ver = detect_macos(args.path)
        minimum = MAC_MIN
    elif system == 'linux':
        source, ver = detect_linux(args.path)
        minimum = LINUX_MIN
    else:
        print('UNKNOWN: unsupported platform {}'.format(platform.system()))
        sys.exit(2)

    if ver is None:
        print('UNKNOWN: could not determine installed Chrome version')
        sys.exit(2)

    patched = compare_versions(ver, minimum)
    if patched is None:
        print('UNKNOWN: version comparison failed')
        sys.exit(2)

    if patched:
        print('PATCHED: detected version {} from {} (minimum safe {})'.format(version_to_str(ver), source, version_to_str(minimum)))
        sys.exit(0)
    else:
        print('VULNERABLE: detected version {} from {} (requires >= {})'.format(version_to_str(ver), source, version_to_str(minimum)))
        sys.exit(1)


if __name__ == '__main__':
    main()