Google Chrome Codecs race condition sandbox escape component on Windows

# check-chrome-cve-2026-10940.ps1

# Purpose: Detect whether Google Chrome on Windows is older than 149.0.7827.53

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromeCandidates {
    $paths = New-Object System.Collections.Generic.List[string]

    $envPaths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    foreach ($p in $envPaths) {
        if ($p -and (Test-Path $p)) { [void]$paths.Add($p) }
    }

    $regKeys = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($key in $regKeys) {
        $defaultValue = (Get-Item $key).GetValue('')
        if ($defaultValue -and (Test-Path $defaultValue)) { [void]$paths.Add($defaultValue) }
    }

    return $paths | Sort-Object -Unique
}

function Get-FileVersionObject([string]$path) {
    try {
        $fv = (Get-Item $path).VersionInfo.FileVersion
        if (-not $fv) { return $null }
        $parts = ($fv -split '[^0-9]+' | Where-Object { $_ -match '^\d+$' })
        if ($parts.Count -lt 4) { return $null }
        return [version]("{0}.{1}.{2}.{3}" -f $parts[0], $parts[1], $parts[2], $parts[3])
    }
    catch {
        return $null
    }
}

$candidates = Get-ChromeCandidates
if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN'
    exit 2
}

$foundAnyVersion = $false
$foundVulnerable = $false
$results = @()

foreach ($chrome in $candidates) {
    $ver = Get-FileVersionObject $chrome
    if ($ver -ne $null) {
        $foundAnyVersion = $true
        $state = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
        $results += [pscustomobject]@{
            Path    = $chrome
            Version = $ver.ToString()
            State   = $state
        }
        if ($ver -lt $fixedVersion) { $foundVulnerable = $true }
    }
}

if (-not $foundAnyVersion) {
    Write-Output 'UNKNOWN'
    exit 2
}

# Optional detail for management tooling logs

$results | ForEach-Object { Write-Verbose ($_.Path + ' -> ' + $_.Version + ' -> ' + $_.State) }

if ($foundVulnerable) {
    Write-Output 'VULNERABLE'
    exit 1
}
else {
    Write-Output 'PATCHED'
    exit 0
}