Google Chrome Glic improper input validation information disclosure

#!/usr/bin/env python3
# check_cve_2026_11027.py
# Determine likely exposure to CVE-2026-11027 by checking local Chrome/Chromium version.
# Outputs one of: VULNERABLE, PATCHED, UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIX_WINDOWS_MAC = (149, 0, 7827, 53)  # Chrome post indicates .53/.54 on Win/Mac; .53 is minimum safe floor
FIX_LINUX = (149, 0, 7827, 53)

CANDIDATES = {
    'Windows': [
        r'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files\\Chromium\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Chromium\\Application\\chrome.exe',
    ],
    'Darwin': [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ],
    'Linux': [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium',
    ],
}

VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(s):
    m = VERSION_RE.search(s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(binary):
    try:
        cp = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=8)
        out = (cp.stdout or '') + ' ' + (cp.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def find_binary():
    system = platform.system()
    # Check PATH first
    for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        p = shutil.which(name)
        if p:
            v = run_version(p)
            if v:
                return p, v
    # Check well-known locations
    for p in CANDIDATES.get(system, []):
        if Path(p).exists():
            v = run_version(p)
            if v:
                return p, v
    return None, None


def version_lt(a, b):
    return a < b


def main():
    system = platform.system()
    binary, version = find_binary()

    if not version:
        print('UNKNOWN: Chrome/Chromium binary not found or version unreadable')
        sys.exit(2)

    if system == 'Linux':
        fixed = FIX_LINUX
    elif system in ('Windows', 'Darwin'):
        fixed = FIX_WINDOWS_MAC
    else:
        print(f'UNKNOWN: Unsupported platform {system}; detected version {version} from {binary}')
        sys.exit(2)

    version_str = '.'.join(map(str, version))
    fixed_str = '.'.join(map(str, fixed))

    if version_lt(version, fixed):
        print(f'VULNERABLE: detected {version_str} at {binary}; fixed floor is {fixed_str}')
        sys.exit(1)
    else:
        print(f'PATCHED: detected {version_str} at {binary}; fixed floor is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()