Google Chrome Dawn improper input validation cross-origin data leak on Windows

# check-chrome-cve-2026-10968.ps1

# Purpose: Detect whether Google Chrome on Windows is vulnerable to CVE-2026-10968

# Vulnerable if installed version is less than 149.0.7827.53

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromeCandidates {
    $paths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rp in $regPaths) {
        $reg = Get-ItemProperty -Path $rp
        if ($reg -and $reg.'(default)') { $paths += $reg.'(default)' }
        if ($reg -and $reg.Path) { $paths += (Join-Path $reg.Path 'chrome.exe') }
    }

    $paths | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

function Get-FileVersion([string]$path) {
    try {
        return [version](Get-Item $path).VersionInfo.FileVersion
    } catch {
        return $null
    }
}

$candidates = Get-ChromeCandidates
if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN: chrome.exe not found in common paths or registry.'
    exit 2
}

$results = @()
foreach ($c in $candidates) {
    $ver = Get-FileVersion -path $c
    if ($ver) {
        $results += [pscustomobject]@{
            Path = $c
            Version = $ver
            Status = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
        }
    }
}

if (-not $results -or $results.Count -eq 0) {
    Write-Output 'UNKNOWN: Chrome located, but version could not be determined.'
    exit 2
}

$results | Sort-Object Path | ForEach-Object {
    Write-Output ("{0}: {1} [{2}]" -f $_.Status, $_.Path, $_.Version)
}

if ($results.Status -contains 'VULNERABLE') {
    Write-Output 'VULNERABLE'
    exit 1
}

Write-Output 'PATCHED'
exit 0