Google Chrome Link Preview inappropriate implementation requiring prior renderer compromise

#!/usr/bin/env python3
# Check Chrome version exposure for CVE-2026-11017
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from typing import List, Optional, Tuple

THRESHOLD = (149, 0, 7827, 53)


def parse_ver(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v: Tuple[int, int, int, int]) -> str:
    return '.'.join(str(x) for x in v)


def run_version(path: str) -> Optional[Tuple[int, int, int, int]]:
    try:
        proc = subprocess.run([path, '--version'], capture_output=True, text=True, timeout=10)
        out = (proc.stdout or '') + ' ' + (proc.stderr or '')
        return parse_ver(out)
    except Exception:
        return None


def candidates() -> List[str]:
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        envs = [
            os.environ.get('ProgramFiles'),
            os.environ.get('ProgramFiles(x86)'),
            os.environ.get('LocalAppData')
        ]
        suffixes = [
            r'Google\\Chrome\\Application\\chrome.exe',
        ]
        for base in envs:
            if not base:
                continue
            for suffix in suffixes:
                paths.append(os.path.join(base, suffix))
    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
        ])
    else:
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/opt/google/chrome/google-chrome',
            '/snap/bin/chromium',
            '/usr/bin/chromium-browser',
            '/usr/bin/chromium'
        ])

    # Only keep unique values while preserving order
    seen = set()
    uniq = []
    for p in paths:
        if p not in seen:
            seen.add(p)
            uniq.append(p)
    return uniq


def main() -> int:
    targets = []
    if len(sys.argv) > 1:
        targets.append(sys.argv[1])
    targets.extend(candidates())

    checked = []
    for path in targets:
        if not path or not os.path.exists(path):
            continue
        ver = run_version(path)
        checked.append((path, ver))
        if ver is None:
            continue

        if ver < THRESHOLD:
            print(f'VULNERABLE: {path} version {version_to_str(ver)} is below {version_to_str(THRESHOLD)}')
            return 1
        else:
            print(f'PATCHED: {path} version {version_to_str(ver)} is at or above {version_to_str(THRESHOLD)}')
            return 0

    if checked:
        details = '; '.join([f'{p}=unparseable' if v is None else f'{p}={version_to_str(v)}' for p, v in checked])
        print(f'UNKNOWN: Chrome binary found but version could not be reliably parsed ({details})')
    else:
        print('UNKNOWN: No Chrome binary found in standard locations and no explicit path was provided')
    return 2


if __name__ == '__main__':
    sys.exit(main())