Out of bounds write in Codecs in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11037.py
# Determine whether local Google Chrome installation is below fixed versions
# for CVE-2026-11037.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)
WINDOWS_FIXED_MAC_PATCH = 54  # Windows/Mac may be .53 or .54 depending on channel rollout; .53 is fixed per release note, .54 also fixed.


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_candidates():
    cands = []
    env_paths = [
        os.path.join(os.environ.get('ProgramFiles', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for p in env_paths:
        if p and os.path.exists(p):
            cands.append(p)
    return list(dict.fromkeys(cands))


def get_windows_version(path):
    ps = [
        'powershell', '-NoProfile', '-Command',
        f"(Get-Item '{path}').VersionInfo.ProductVersion"
    ]
    return parse_version(run_cmd(ps))


def mac_candidates():
    cands = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    return [p for p in cands if os.path.exists(p)]


def linux_candidates():
    names = [
        'google-chrome', 'google-chrome-stable', 'chrome',
        '/opt/google/chrome/chrome', '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable'
    ]
    cands = []
    for n in names:
        if n.startswith('/'):
            if os.path.exists(n):
                cands.append(n)
        else:
            out = run_cmd(['sh', '-c', f'command -v {n}'])
            if out:
                cands.append(out.splitlines()[0].strip())
    return list(dict.fromkeys(cands))


def get_unix_version(path):
    out = run_cmd([path, '--version'])
    return parse_version(out)


def status_for_version(ver, system_name):
    if ver is None:
        return 'UNKNOWN'
    # Public release note says Linux fixed at .53 and Windows/Mac at .53/.54.
    # Treat 149.0.7827.53+ as patched across platforms for this check.
    if version_lt(ver, FIXED):
        return 'VULNERABLE'
    return 'PATCHED'


def main():
    system_name = platform.system()
    findings = []

    if system_name == 'Windows':
        for path in windows_candidates():
            ver = get_windows_version(path)
            findings.append((path, ver, status_for_version(ver, system_name)))
    elif system_name == 'Darwin':
        for path in mac_candidates():
            ver = get_unix_version(path)
            findings.append((path, ver, status_for_version(ver, system_name)))
    else:
        for path in linux_candidates():
            ver = get_unix_version(path)
            findings.append((path, ver, status_for_version(ver, system_name)))

    if not findings:
        print('UNKNOWN - Google Chrome not found in standard locations')
        sys.exit(2)

    vulnerable = [f for f in findings if f[2] == 'VULNERABLE']
    patched = [f for f in findings if f[2] == 'PATCHED']

    for path, ver, state in findings:
        vtxt = '.'.join(str(x) for x in ver) if ver else 'unreadable'
        print(f'{state} - {path} - version {vtxt}')

    if vulnerable:
        print('VULNERABLE')
        sys.exit(1)
    elif patched:
        print('PATCHED')
        sys.exit(0)
    else:
        print('UNKNOWN')
        sys.exit(2)


if __name__ == '__main__':
    main()