Heap buffer overflow in Skia in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_10993.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

TARGET = (149, 0, 7827, 53)  # Treat 149.0.7827.53+ as fixed across platforms for this check.
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_windows():
    try:
        import winreg
    except Exception:
        winreg = None

    # First try BLBeacon registry keys used by Chrome.
    if winreg:
        reg_paths = [
            (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon', 'version'),
            (winreg.HKEY_LOCAL_MACHINE, r'Software\Google\Chrome\BLBeacon', 'version'),
            (winreg.HKEY_LOCAL_MACHINE, r'Software\WOW6432Node\Google\Chrome\BLBeacon', 'version'),
        ]
        for hive, path, name in reg_paths:
            try:
                with winreg.OpenKey(hive, path) as key:
                    val, _ = winreg.QueryValueEx(key, name)
                    ver = parse_version(str(val))
                    if ver:
                        return ver, f'registry:{path}'
            except Exception:
                pass

    # Fall back to executable version output.
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for exe in candidates:
        if exe and os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, exe
    return None, ''


def detect_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for exe in candidates:
        if os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, exe
    plist_candidates = [
        '/Applications/Google Chrome.app/Contents/Info.plist',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/Info.plist'),
    ]
    for plist in plist_candidates:
        if os.path.exists(plist):
            out = run_cmd(['/usr/bin/defaults', 'read', plist, 'CFBundleShortVersionString'])
            ver = parse_version(out)
            if ver:
                return ver, plist
    return None, ''


def detect_linux():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, ' '.join(cmd)
    return None, ''


def main():
    system = platform.system().lower()
    if 'windows' in system:
        ver, src = detect_windows()
    elif 'darwin' in system:
        ver, src = detect_macos()
    elif 'linux' in system:
        ver, src = detect_linux()
    else:
        print('UNKNOWN - unsupported platform')
        sys.exit(2)

    if not ver:
        print('UNKNOWN - Google Chrome version not found')
        sys.exit(2)

    if cmp_ver(ver, TARGET) >= 0:
        print(f'PATCHED - detected Chrome version {".".join(map(str, ver))} via {src}')
        sys.exit(0)
    else:
        print(f'VULNERABLE - detected Chrome version {".".join(map(str, ver))} via {src}')
        sys.exit(1)


if __name__ == '__main__':
    main()