Use after free in Autofill in Google Chrome on iOS prior to 149

#!/usr/bin/env python3
# check_chrome_ios_cve_2026_10951.py
#
# Purpose:
#   Audit MDM/EMM CSV exports for Chrome on iOS versions vulnerable to CVE-2026-10951.
#
# Usage:
#   python3 check_chrome_ios_cve_2026_10951.py devices.csv
#
# Expected CSV:
#   Flexible column matching. The script looks for likely device/app/version columns.
#   Best effort fields include:
#     - device_name / device / hostname / serial / user
#     - app_name / application / bundle_id / package
#     - version / app_version / installed_version
#     - platform / os / operating_system (optional, used to filter iOS/iPadOS rows)
#
# Exit codes:
#   0 = all matching Chrome iOS installs are PATCHED, or none found
#   1 = one or more VULNERABLE installs found
#   2 = UNKNOWN / parse failure / insufficient data

import csv
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)
CHROME_NAMES = {
    'google chrome', 'chrome', 'chrome ios', 'google chrome: fast & secure'
}
CHROME_BUNDLES = {
    'com.google.chrome.ios', 'com.google.chrome'
}
IOS_MARKERS = {'ios', 'ipados', 'iphone', 'ipad'}


def norm(s):
    return (s or '').strip().lower()


def parse_version(v):
    v = (v or '').strip()
    if not v:
        return None
    parts = []
    for token in v.split('.'):
        token = token.strip()
        if not token.isdigit():
            num = ''
            for ch in token:
                if ch.isdigit():
                    num += ch
                else:
                    break
            token = num
        if token == '':
            break
        parts.append(int(token))
    if not parts:
        return None
    while len(parts) < 4:
        parts.append(0)
    return tuple(parts[:4])


def cmp_ver(a, b):
    return (a > b) - (a < b)


def pick(row, candidates):
    lowered = {k.lower(): k for k in row.keys()}
    for c in candidates:
        if c in lowered:
            return row.get(lowered[c], '')
    return ''


def row_is_ios(row):
    platform = norm(pick(row, ['platform', 'os', 'operating_system', 'device_os']))
    if not platform:
        return True  # don't exclude if platform field absent
    return any(marker in platform for marker in IOS_MARKERS)


def row_is_chrome(row):
    app = norm(pick(row, ['app_name', 'application', 'app', 'name', 'package_name']))
    bundle = norm(pick(row, ['bundle_id', 'bundle', 'package', 'identifier']))
    return app in CHROME_NAMES or bundle in CHROME_BUNDLES or 'chrome' in app or bundle.startswith('com.google.chrome')


def device_label(row):
    for field in ['device_name', 'device', 'hostname', 'serial', 'user', 'username', 'owner']:
        value = pick(row, [field])
        if value:
            return value
    return '<unknown-device>'


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_chrome_ios_cve_2026_10951.py devices.csv')
        sys.exit(2)

    path = Path(sys.argv[1])
    if not path.exists() or not path.is_file():
        print(f'UNKNOWN - file not found: {path}')
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []
    matched_any = False

    try:
        with path.open('r', encoding='utf-8-sig', newline='') as f:
            reader = csv.DictReader(f)
            if not reader.fieldnames:
                print('UNKNOWN - CSV has no header row')
                sys.exit(2)

            for row in reader:
                if not row_is_ios(row):
                    continue
                if not row_is_chrome(row):
                    continue

                matched_any = True
                version_raw = pick(row, ['version', 'app_version', 'installed_version', 'application_version'])
                version = parse_version(version_raw)
                label = device_label(row)

                if version is None:
                    unknown.append((label, version_raw or '<blank>'))
                    continue

                if cmp_ver(version, FIXED) < 0:
                    vulnerable.append((label, version_raw))
                else:
                    patched.append((label, version_raw))

    except Exception as e:
        print(f'UNKNOWN - parse error: {e}')
        sys.exit(2)

    if not matched_any:
        print('UNKNOWN - no Chrome on iOS rows matched; verify your CSV columns and app naming')
        sys.exit(2)

    for label, ver in vulnerable:
        print(f'VULNERABLE,{label},{ver}')
    for label, ver in patched:
        print(f'PATCHED,{label},{ver}')
    for label, ver in unknown:
        print(f'UNKNOWN,{label},{ver}')

    if vulnerable:
        sys.exit(1)
    if unknown and not patched:
        sys.exit(2)
    sys.exit(0)


if __name__ == '__main__':
    main()