Out of bounds read in Skia in Google Chrome prior to 149

#!/usr/bin/env python3
# Check Google Chrome version exposure for CVE-2026-10985
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR

import os
import platform
import plistlib
import re
import shutil
import subprocess
import sys

MIN_VERSION = (149, 0, 7827, 53)


def parse_version(v):
    if not v:
        return None
    m = re.findall(r"\d+", str(v))
    if len(m) < 4:
        return None
    return tuple(int(x) for x in m[:4])


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip()
    except Exception:
        pass
    return None


def get_windows_version():
    # Prefer registry beacon values used by Chrome installers.
    try:
        import winreg
    except Exception:
        return None

    reg_paths = [
        (winreg.HKEY_CURRENT_USER, r"Software\Google\Chrome\BLBeacon", "version"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\Google\Chrome\BLBeacon", "version"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\WOW6432Node\Google\Chrome\BLBeacon", "version"),
        (winreg.HKEY_CURRENT_USER, r"Software\Chromium\BLBeacon", "version"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\Chromium\BLBeacon", "version"),
    ]
    for hive, path, name in reg_paths:
        try:
            with winreg.OpenKey(hive, path) as k:
                value, _ = winreg.QueryValueEx(k, name)
                if value:
                    return value
        except Exception:
            continue

    # Fallback to executable version if available.
    possible = [
        os.path.join(os.environ.get("ProgramFiles", r"C:\Program Files"), "Google", "Chrome", "Application", "chrome.exe"),
        os.path.join(os.environ.get("ProgramFiles(x86)", r"C:\Program Files (x86)"), "Google", "Chrome", "Application", "chrome.exe"),
    ]
    for exe in possible:
        if os.path.exists(exe):
            try:
                import win32api  # type: ignore
                info = win32api.GetFileVersionInfo(exe, "\\")
                ms = info['FileVersionMS']
                ls = info['FileVersionLS']
                return f"{ms >> 16}.{ms & 0xFFFF}.{ls >> 16}.{ls & 0xFFFF}"
            except Exception:
                continue
    return None


def get_macos_version():
    plist_paths = [
        "/Applications/Google Chrome.app/Contents/Info.plist",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/Info.plist"),
        "/Applications/Chromium.app/Contents/Info.plist",
        os.path.expanduser("~/Applications/Chromium.app/Contents/Info.plist"),
    ]
    for p in plist_paths:
        if os.path.exists(p):
            try:
                with open(p, "rb") as f:
                    data = plistlib.load(f)
                for key in ("KSVersion", "CFBundleShortVersionString", "CFBundleVersion"):
                    if data.get(key):
                        return str(data[key])
            except Exception:
                continue

    binaries = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        "/Applications/Chromium.app/Contents/MacOS/Chromium",
    ]
    for b in binaries:
        if os.path.exists(b):
            out = run_cmd([b, "--version"])
            if out:
                return out
    return None


def get_linux_version():
    candidates = [
        "google-chrome",
        "google-chrome-stable",
        "chromium-browser",
        "chromium",
    ]
    for cmd in candidates:
        full = shutil.which(cmd)
        if full:
            out = run_cmd([full, "--version"])
            if out:
                return out
    return None


def main():
    system = platform.system().lower()
    version_raw = None

    if "windows" in system:
        version_raw = get_windows_version()
    elif "darwin" in system:
        version_raw = get_macos_version()
    elif "linux" in system:
        version_raw = get_linux_version()
    else:
        print("UNKNOWN: unsupported platform")
        sys.exit(2)

    parsed = parse_version(version_raw)
    if not parsed:
        print("UNKNOWN: Chrome version not found")
        sys.exit(2)

    if cmp_version(parsed, MIN_VERSION) < 0:
        print(f"VULNERABLE: detected Chrome/Chromium version {'.'.join(map(str, parsed))} < {'.'.join(map(str, MIN_VERSION))}")
        sys.exit(1)
    else:
        print(f"PATCHED: detected Chrome/Chromium version {'.'.join(map(str, parsed))} >= {'.'.join(map(str, MIN_VERSION))}")
        sys.exit(0)


if __name__ == "__main__":
    try:
        main()
    except Exception as e:
        print(f"UNKNOWN: error during check: {e}")
        sys.exit(3)