Out of bounds read in ANGLE in Google Chrome prior to 149

#!/usr/bin/env python3
# Check for Chrome versions vulnerable to CVE-2026-11004
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(v):
    return '.'.join(str(x) for x in v)


def run_cmd(cmd):
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (r.stdout or '') + (r.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version_from_registry():
    reg_paths = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
    ]
    for reg_path in reg_paths:
        out = run_cmd(['reg', 'query', reg_path, '/v', 'version'])
        v = parse_version(out)
        if v:
            return v, f'registry:{reg_path}'
    return None, None


def get_version_from_binary(path):
    out = run_cmd([path, '--version'])
    v = parse_version(out)
    if v:
        return v, path
    return None, None


def candidate_paths(user_path=None):
    paths = []
    if user_path:
        paths.append(user_path)

    for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        p = shutil.which(name)
        if p:
            paths.append(p)

    system = platform.system().lower()
    if system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ])
    elif system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        program_files = os.environ.get('ProgramFiles', '')
        program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
        paths.extend([
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(program_files, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(program_files_x86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ])
    else:
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/opt/google/chrome/chrome',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
        ])

    seen = set()
    deduped = []
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            deduped.append(p)
    return deduped


def main():
    parser = argparse.ArgumentParser(description='Detect vulnerable Chrome versions for CVE-2026-11004')
    parser.add_argument('--path', help='Explicit path to Chrome binary')
    args = parser.parse_args()

    system = platform.system().lower()

    for p in candidate_paths(args.path):
        if os.path.exists(p):
            v, source = get_version_from_binary(p)
            if v:
                if v < TARGET:
                    print(f'VULNERABLE - detected Chrome version {ver_to_str(v)} from {source}; fixed version is {ver_to_str(TARGET)} or newer')
                    sys.exit(1)
                else:
                    print(f'PATCHED - detected Chrome version {ver_to_str(v)} from {source}; meets or exceeds fixed version {ver_to_str(TARGET)}')
                    sys.exit(0)

    if system == 'windows':
        v, source = get_windows_version_from_registry()
        if v:
            if v < TARGET:
                print(f'VULNERABLE - detected Chrome version {ver_to_str(v)} from {source}; fixed version is {ver_to_str(TARGET)} or newer')
                sys.exit(1)
            else:
                print(f'PATCHED - detected Chrome version {ver_to_str(v)} from {source}; meets or exceeds fixed version {ver_to_str(TARGET)}')
                sys.exit(0)

    print('UNKNOWN - could not determine an installed Chrome version; provide --path to the browser binary or verify installation method')
    sys.exit(2)


if __name__ == '__main__':
    main()