Google Chrome Extensions insufficient policy enforcement allowing malicious extension abuse

#!/usr/bin/env python3
# CVE-2026-10997 Chrome version check
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

import os
import platform
import re
import subprocess
import sys

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def get_windows_version():
    try:
        import winreg
    except Exception:
        winreg = None

    paths = [
        (r'SOFTWARE\\Google\\Chrome\\BLBeacon', 'version', False),
        (r'SOFTWARE\\WOW6432Node\\Google\\Chrome\\BLBeacon', 'version', False),
        (r'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome', 'DisplayVersion', False),
    ]

    if winreg:
        for subkey, value_name, current_user in paths:
            hive = winreg.HKEY_CURRENT_USER if current_user else winreg.HKEY_LOCAL_MACHINE
            try:
                key = winreg.OpenKey(hive, subkey)
                val, _ = winreg.QueryValueEx(key, value_name)
                ver = parse_version(str(val))
                if ver:
                    return ver, f'registry:{subkey}:{value_name}'
            except OSError:
                pass

    candidates = [
        os.path.expandvars(r'%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\\Google\\Chrome\\Application\\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\\Google\\Chrome\\Application\\chrome.exe'),
    ]
    for exe in candidates:
        if exe and os.path.exists(exe):
            try:
                out = subprocess.check_output([exe, '--version'], stderr=subprocess.STDOUT, text=True, timeout=10)
                ver = parse_version(out)
                if ver:
                    return ver, exe
            except Exception:
                pass
    return None, ''


def get_macos_version():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for exe in candidates:
        if os.path.exists(exe):
            try:
                out = subprocess.check_output([exe, '--version'], stderr=subprocess.STDOUT, text=True, timeout=10)
                ver = parse_version(out)
                if ver:
                    return ver, exe
            except Exception:
                pass
    return None, ''


def get_linux_version():
    commands = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in commands:
        try:
            out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
            ver = parse_version(out)
            if ver:
                return ver, ' '.join(cmd)
        except Exception:
            pass

    candidates = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
        '/usr/bin/chromium-browser',
        '/usr/bin/chromium',
    ]
    for exe in candidates:
        if os.path.exists(exe):
            try:
                out = subprocess.check_output([exe, '--version'], stderr=subprocess.STDOUT, text=True, timeout=10)
                ver = parse_version(out)
                if ver:
                    return ver, exe
            except Exception:
                pass
    return None, ''


def main():
    system = platform.system().lower()
    if 'windows' in system:
        ver, source = get_windows_version()
    elif 'darwin' in system:
        ver, source = get_macos_version()
    else:
        ver, source = get_linux_version()

    if not ver:
        print('UNKNOWN - could not determine installed Chrome/Chromium version')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in TARGET)

    if ver < TARGET:
        print(f'VULNERABLE - detected version {version_str} via {source}; fixed version is {fixed_str} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - detected version {version_str} via {source}; fixed threshold is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()