Google Chrome WebXR use-after-free leading to sandboxed code execution

#!/usr/bin/env python3
# CVE-2026-10982 local exposure check for Chrome/Chromium desktop builds
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIX_WINDOWS_MAC = (149, 0, 7827, 54)  # .53/.54 released; .54 is safest floor for Win/Mac checks
FIX_LINUX = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_commands():
    system = platform.system()
    cmds = []

    if system == 'Windows':
        local = os.environ.get('LOCALAPPDATA', '')
        program_files = os.environ.get('ProgramFiles', '')
        program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
        cmds.extend([
            [str(Path(local) / 'Google/Chrome/Application/chrome.exe'), '--version'],
            [str(Path(program_files) / 'Google/Chrome/Application/chrome.exe'), '--version'],
            [str(Path(program_files_x86) / 'Google/Chrome/Application/chrome.exe'), '--version'],
            [str(Path(program_files) / 'Chromium/Application/chrome.exe'), '--version'],
            [str(Path(program_files_x86) / 'Chromium/Application/chrome.exe'), '--version'],
        ])
    elif system == 'Darwin':
        cmds.extend([
            ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '--version'],
            ['/Applications/Chromium.app/Contents/MacOS/Chromium', '--version'],
            ['/Applications/Google Chrome Beta.app/Contents/MacOS/Google Chrome Beta', '--version'],
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            path = shutil.which(name)
            if path:
                cmds.append([path, '--version'])

    return cmds


def compare(v1, v2):
    return (v1 > v2) - (v1 < v2)


def main():
    system = platform.system()
    fixed = FIX_WINDOWS_MAC if system in ('Windows', 'Darwin') else FIX_LINUX

    findings = []
    for cmd in candidate_commands():
        exe = cmd[0]
        if not os.path.exists(exe) and not shutil.which(exe):
            continue
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            findings.append((exe, ver, out.strip()))

    if not findings:
        print('UNKNOWN: no supported Chrome/Chromium executable found')
        sys.exit(2)

    # Choose the highest discovered version as the effective browser version.
    findings.sort(key=lambda x: x[1], reverse=True)
    exe, ver, raw = findings[0]

    if compare(ver, fixed) >= 0:
        print(f'PATCHED: {exe} -> {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} (fixed floor {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]})')
        sys.exit(0)
    else:
        print(f'VULNERABLE: {exe} -> {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} (fixed floor {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]})')
        sys.exit(1)


if __name__ == '__main__':
    main()