Google Chrome Input insufficient input validation allowing post-renderer-compromise browser boundary bypass

#!/usr/bin/env python3
# CVE-2026-10938 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

PATCH_MIN = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return parse_version(out), out.strip()
    except Exception:
        return None, ''


def candidate_paths():
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        envs = [
            os.environ.get('PROGRAMFILES'),
            os.environ.get('PROGRAMFILES(X86)'),
            os.environ.get('LOCALAPPDATA'),
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe',
        ]
        for base in envs:
            if not base:
                continue
            for suffix in suffixes:
                paths.append(str(Path(base) / suffix))

    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            str(Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium'),
        ])

    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            found = shutil.which(name)
            if found:
                paths.append(found)
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium',
            '/opt/google/chrome/chrome',
        ])

    # de-duplicate while preserving order
    seen = set()
    uniq = []
    for p in paths:
        if p and p not in seen:
            uniq.append(p)
            seen.add(p)
    return uniq


def compare_version(v):
    return v >= PATCH_MIN


def main():
    tested = []
    found_any = False

    for path in candidate_paths():
        if os.path.exists(path) or shutil.which(path):
            found_any = True
            version, raw = run_version([path, '--version'])
            tested.append((path, version, raw))
            if version is not None:
                if compare_version(version):
                    print(f'PATCHED - {path} - version {".".join(map(str, version))}')
                    sys.exit(0)
                else:
                    print(f'VULNERABLE - {path} - version {".".join(map(str, version))}')
                    sys.exit(1)

    if not found_any:
        print('UNKNOWN - Chrome/Chromium executable not found in common locations')
        sys.exit(2)

    # Found something but could not parse any version
    print('UNKNOWN - Found browser executable(s) but could not parse version')
    for path, version, raw in tested:
        msg = raw.replace('\n', ' ').strip()
        if len(msg) > 120:
            msg = msg[:117] + '...'
        print(f'INFO - {path} - raw output: {msg}')
    sys.exit(2)


if __name__ == '__main__':
    main()