Insufficient data validation in Animation in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-10992 Chrome version check
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / Chrome not found / cannot determine

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path


def parse_version(v):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', v or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return 99, ''


def find_windows_version():
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for exe in candidates:
        if exe and os.path.exists(exe):
            try:
                import ctypes
                from ctypes import wintypes

                GetFileVersionInfoSizeW = ctypes.windll.version.GetFileVersionInfoSizeW
                GetFileVersionInfoW = ctypes.windll.version.GetFileVersionInfoW
                VerQueryValueW = ctypes.windll.version.VerQueryValueW

                size = GetFileVersionInfoSizeW(exe, None)
                if not size:
                    continue
                res = ctypes.create_string_buffer(size)
                if not GetFileVersionInfoW(exe, 0, size, res):
                    continue
                lptr = ctypes.c_void_p()
                lsize = wintypes.UINT()
                if not VerQueryValueW(res, '\\', ctypes.byref(lptr), ctypes.byref(lsize)):
                    continue
                class VS_FIXEDFILEINFO(ctypes.Structure):
                    _fields_ = [
                        ('dwSignature', wintypes.DWORD),
                        ('dwStrucVersion', wintypes.DWORD),
                        ('dwFileVersionMS', wintypes.DWORD),
                        ('dwFileVersionLS', wintypes.DWORD),
                        ('dwProductVersionMS', wintypes.DWORD),
                        ('dwProductVersionLS', wintypes.DWORD),
                        ('dwFileFlagsMask', wintypes.DWORD),
                        ('dwFileFlags', wintypes.DWORD),
                        ('dwFileOS', wintypes.DWORD),
                        ('dwFileType', wintypes.DWORD),
                        ('dwFileSubtype', wintypes.DWORD),
                        ('dwFileDateMS', wintypes.DWORD),
                        ('dwFileDateLS', wintypes.DWORD),
                    ]
                ffi = ctypes.cast(lptr.value, ctypes.POINTER(VS_FIXEDFILEINFO)).contents
                ms = ffi.dwFileVersionMS
                ls = ffi.dwFileVersionLS
                version = f'{(ms >> 16) & 0xFFFF}.{ms & 0xFFFF}.{(ls >> 16) & 0xFFFF}.{ls & 0xFFFF}'
                return exe, version
            except Exception:
                rc, out = run_cmd(['powershell', '-NoProfile', '-Command', f"(Get-Item '{exe}').VersionInfo.ProductVersion"])
                if rc == 0 and out:
                    return exe, out.splitlines()[-1].strip()
    return None, None


def find_macos_version():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(app):
        rc, out = run_cmd([app, '--version'])
        if rc == 0 and out:
            return app, out
    return None, None


def find_linux_version():
    for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
        path = shutil.which(name)
        if path:
            rc, out = run_cmd([path, '--version'])
            if rc == 0 and out:
                return path, out
    candidates = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
    ]
    for path in candidates:
        if os.path.exists(path):
            rc, out = run_cmd([path, '--version'])
            if rc == 0 and out:
                return path, out
    return None, None


def main():
    system = platform.system().lower()
    path = version_str = None

    if 'windows' in system:
        path, version_str = find_windows_version()
        fixed = (149, 0, 7827, 54)  # Windows/Mac fixed at 149.0.7827.53/54; treat .54+ as clearly patched
        os_label = 'windows'
    elif 'darwin' in system:
        path, version_str = find_macos_version()
        fixed = (149, 0, 7827, 54)  # Windows/Mac
        os_label = 'macos'
    else:
        path, version_str = find_linux_version()
        fixed = (149, 0, 7827, 53)  # Linux
        os_label = 'linux'

    if not path or not version_str:
        print('UNKNOWN - Chrome not found or version could not be determined')
        sys.exit(2)

    ver = parse_version(version_str)
    if not ver:
        print(f'UNKNOWN - Found Chrome at {path} but could not parse version from: {version_str}')
        sys.exit(2)

    if cmp_ver(ver, fixed) < 0:
        print(f'VULNERABLE - {os_label} Chrome version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} is below fixed version {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]}')
        sys.exit(1)

    print(f'PATCHED - {os_label} Chrome version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} meets or exceeds fixed version {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]}')
    sys.exit(0)


if __name__ == '__main__':
    main()