Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149

#!/usr/bin/env python3
# Check exposure to CVE-2026-11031 by Google Chrome version.
# Fixed version baseline: 149.0.7827.53
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True).strip()
        return out
    except Exception:
        return None


def detect_windows():
    candidates = []
    try:
        import winreg  # type: ignore
        reg_paths = [
            r'SOFTWARE\\Google\\Chrome\\BLBeacon',
            r'SOFTWARE\\WOW6432Node\\Google\\Chrome\\BLBeacon',
        ]
        for hive in (winreg.HKEY_CURRENT_USER, winreg.HKEY_LOCAL_MACHINE):
            for path in reg_paths:
                try:
                    with winreg.OpenKey(hive, path) as k:
                        version, _ = winreg.QueryValueEx(k, 'version')
                        pv = parse_version(str(version))
                        if pv:
                            candidates.append((pv, f'Registry:{path}'))
                except Exception:
                    pass
    except Exception:
        pass

    env_paths = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for p in env_paths:
        if p and os.path.exists(p):
            out = run_cmd([p, '--version'])
            pv = parse_version(out)
            if pv:
                candidates.append((pv, p))

    return max(candidates, default=(None, None), key=lambda x: x[0] or (0, 0, 0, 0))


def detect_macos():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(app):
        out = run_cmd([app, '--version'])
        pv = parse_version(out)
        if pv:
            return pv, app
    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        out = run_cmd(['/usr/bin/defaults', 'read', plist, 'CFBundleShortVersionString'])
        pv = parse_version(out)
        if pv:
            return pv, plist
    return None, None


def detect_linux():
    bins = [
        'google-chrome',
        'google-chrome-stable',
        '/opt/google/chrome/chrome',
    ]
    for b in bins:
        out = run_cmd([b, '--version']) if not b.startswith('/') or os.path.exists(b) else None
        pv = parse_version(out)
        if pv:
            return pv, b
    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'windows' in system:
        version, source = detect_windows()
    elif 'darwin' in system:
        version, source = detect_macos()
    elif 'linux' in system:
        version, source = detect_linux()

    if not version:
        print('UNKNOWN')
        sys.exit(2)

    if cmp_ver(version, FIXED) < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()