Uninitialized Use in ANGLE in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_10994.py
# Determine whether a local Google Chrome installation is vulnerable to CVE-2026-10994.
# Fixed baseline used here: 149.0.7827.53 (Linux) and 149.0.7827.53/.54 (Windows/macOS).
# Any version < 149.0.7827.53 is treated as VULNERABLE.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def read_cmd(path):
    try:
        out = subprocess.check_output([path, '--version'], stderr=subprocess.STDOUT, text=True, timeout=5)
        return out.strip()
    except Exception:
        return None


def check_windows_registry():
    versions = []
    try:
        import winreg  # type: ignore
    except Exception:
        return versions

    roots = [
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon'),
        (winreg.HKEY_CURRENT_USER, r'SOFTWARE\Google\Chrome\BLBeacon'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon'),
    ]

    for hive, keypath in roots:
        try:
            with winreg.OpenKey(hive, keypath) as k:
                val, _ = winreg.QueryValueEx(k, 'version')
                v = parse_version(str(val))
                if v:
                    versions.append((keypath, v))
        except Exception:
            pass
    return versions


def check_windows_files():
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LOCALAPPDATA', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    versions = []
    for path in candidates:
        if path and os.path.exists(path):
            out = read_cmd(path)
            v = parse_version(out)
            if v:
                versions.append((path, v))
    return versions


def check_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    versions = []
    for path in candidates:
        if os.path.exists(path):
            out = read_cmd(path)
            v = parse_version(out)
            if v:
                versions.append((path, v))
    return versions


def check_linux():
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    versions = []
    for name in names:
        path = shutil.which(name)
        if path:
            out = read_cmd(path)
            v = parse_version(out)
            if v:
                versions.append((path, v))
    return versions


def fmt(v):
    return '.'.join(str(x) for x in v)


def main():
    system = platform.system().lower()
    found = []

    if system == 'windows':
        found.extend(check_windows_registry())
        found.extend(check_windows_files())
    elif system == 'darwin':
        found.extend(check_macos())
    elif system == 'linux':
        found.extend(check_linux())
    else:
        print(f'UNKNOWN - Unsupported platform: {platform.system()}')
        sys.exit(2)

    # De-duplicate by (location, version)
    uniq = []
    seen = set()
    for item in found:
        if item not in seen:
            uniq.append(item)
            seen.add(item)
    found = uniq

    if not found:
        print('UNKNOWN - Google Chrome/Chromium not found or version unreadable')
        sys.exit(2)

    vulnerable = []
    patched = []
    for loc, ver in found:
        if cmp_ver(ver, FIXED) < 0:
            vulnerable.append((loc, ver))
        else:
            patched.append((loc, ver))

    if vulnerable:
        print('VULNERABLE - Found browser version(s) below 149.0.7827.53:')
        for loc, ver in vulnerable:
            print(f'  {loc}: {fmt(ver)}')
        if patched:
            print('Also found patched version(s):')
            for loc, ver in patched:
                print(f'  {loc}: {fmt(ver)}')
        sys.exit(1)

    print('PATCHED - All discovered browser version(s) are >= 149.0.7827.53:')
    for loc, ver in patched:
        print(f'  {loc}: {fmt(ver)}')
    sys.exit(0)


if __name__ == '__main__':
    main()