Use after free in Chrome for iOS in Google Chrome on iOS prior to 149

#!/usr/bin/env python3
# check_chrome_ios_cve_2026_10961.py
# Exit codes:
#   0 = PATCHED (no vulnerable Chrome for iOS entries found)
#   1 = VULNERABLE (one or more vulnerable entries found)
#   2 = UNKNOWN (could not determine from input)

import csv
import re
import sys
from typing import Optional

FIXED_VERSION = "149.0.7827.53"
APP_PATTERNS = [
    re.compile(r"^google chrome$", re.I),
    re.compile(r"^chrome$", re.I),
    re.compile(r"^google chrome for ios$", re.I),
]


def normalize_version(v: str):
    parts = re.findall(r"\d+", v or "")
    if not parts:
        return None
    return tuple(int(x) for x in parts)


def cmp_versions(a: str, b: str) -> Optional[int]:
    va = normalize_version(a)
    vb = normalize_version(b)
    if va is None or vb is None:
        return None
    max_len = max(len(va), len(vb))
    va = va + (0,) * (max_len - len(va))
    vb = vb + (0,) * (max_len - len(vb))
    if va < vb:
        return -1
    if va > vb:
        return 1
    return 0


def is_chrome_ios(app_name: str) -> bool:
    if not app_name:
        return False
    return any(p.match(app_name.strip()) for p in APP_PATTERNS)


def pick(row: dict, *candidates):
    lowered = {k.strip().lower(): v for k, v in row.items() if k is not None}
    for c in candidates:
        if c.lower() in lowered:
            return lowered[c.lower()]
    return ""


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_chrome_ios_cve_2026_10961.py <mdm_export.csv>")
        sys.exit(2)

    path = sys.argv[1]
    found_any = False
    found_chrome = False
    vulnerable = []
    unknown = []

    try:
        with open(path, newline='', encoding='utf-8-sig') as f:
            reader = csv.DictReader(f)
            if not reader.fieldnames:
                print("UNKNOWN - CSV has no header row")
                sys.exit(2)

            for row in reader:
                found_any = True
                device = pick(row, "DeviceName", "Device", "Name", "Hostname", "SerialNumber", "UDID") or "UNKNOWN_DEVICE"
                app = pick(row, "AppName", "Application", "App", "ManagedAppName", "BundleDisplayName")
                version = pick(row, "Version", "AppVersion", "ShortVersion", "CFBundleShortVersionString")
                platform = pick(row, "Platform", "OS", "OperatingSystem")

                # If the export mixes platforms, keep iOS/iPadOS rows preferred but don't hard-fail.
                if app and is_chrome_ios(app):
                    found_chrome = True
                    c = cmp_versions(version, FIXED_VERSION)
                    if c is None:
                        unknown.append((device, version or "<missing>", platform or "<unknown>"))
                    elif c < 0:
                        vulnerable.append((device, version, platform or "<unknown>"))

    except FileNotFoundError:
        print(f"UNKNOWN - file not found: {path}")
        sys.exit(2)
    except Exception as e:
        print(f"UNKNOWN - failed to parse CSV: {e}")
        sys.exit(2)

    if not found_any:
        print("UNKNOWN - CSV contains no data rows")
        sys.exit(2)

    if vulnerable:
        print(f"VULNERABLE - found {len(vulnerable)} device(s) with Chrome for iOS < {FIXED_VERSION}")
        for device, version, platform in vulnerable[:25]:
            print(f"  {device} | version={version} | platform={platform}")
        if len(vulnerable) > 25:
            print(f"  ... {len(vulnerable) - 25} more")
        if unknown:
            print(f"NOTE - {len(unknown)} Chrome row(s) had unreadable versions and need manual review")
        sys.exit(1)

    if found_chrome:
        if unknown:
            print(f"UNKNOWN - no confirmed vulnerable rows, but {len(unknown)} Chrome row(s) had unreadable versions")
            for device, version, platform in unknown[:25]:
                print(f"  {device} | version={version} | platform={platform}")
            sys.exit(2)
        print(f"PATCHED - all discovered Chrome for iOS entries are >= {FIXED_VERSION}")
        sys.exit(0)

    print("UNKNOWN - no Chrome for iOS rows found in the CSV; verify your export includes app inventory")
    sys.exit(2)


if __name__ == "__main__":
    main()