Google Chrome Codecs insufficient input validation sandbox-escape chain flaw

#!/usr/bin/env python3
# Check local Google Chrome version against the fixed build for CVE-2026-10981
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
        return out.strip()
    except Exception:
        return None


def get_windows_version():
    reg_paths = [
        ["reg", "query", r"HKLM\SOFTWARE\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\SOFTWARE\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in reg_paths:
        out = run_cmd(cmd)
        if out:
            v = parse_version(out)
            if v:
                return v, out
    default_paths = [
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    ]
    for p in default_paths:
        if os.path.exists(p):
            ps = [
                "powershell",
                "-NoProfile",
                "-Command",
                f"(Get-Item '{p}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(ps)
            if out:
                v = parse_version(out)
                if v:
                    return v, out
    return None, None


def get_macos_version():
    candidates = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for c in candidates:
        if os.path.exists(c):
            out = run_cmd([c, "--version"])
            if out:
                v = parse_version(out)
                if v:
                    return v, out
    return None, None


def get_linux_version():
    candidates = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["/usr/bin/google-chrome", "--version"],
        ["/usr/bin/google-chrome-stable", "--version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        if out:
            v = parse_version(out)
            if v:
                return v, out
    return None, None


def main():
    system = platform.system()
    if system == "Windows":
        version, raw = get_windows_version()
    elif system == "Darwin":
        version, raw = get_macos_version()
    elif system == "Linux":
        version, raw = get_linux_version()
    else:
        print(f"UNKNOWN: unsupported platform '{system}'")
        sys.exit(2)

    if not version:
        print("UNKNOWN: Google Chrome version not found")
        sys.exit(2)

    version_str = ".".join(str(x) for x in version)
    fixed_str = ".".join(str(x) for x in FIXED)

    if version < FIXED:
        print(f"VULNERABLE: installed Chrome {version_str} is older than fixed {fixed_str}")
        sys.exit(1)
    else:
        print(f"PATCHED: installed Chrome {version_str} is at or above fixed {fixed_str}")
        sys.exit(0)


if __name__ == "__main__":
    main()