Use after free in WebRTC in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11054.py
# Purpose: Determine whether local Google Chrome version is vulnerable to CVE-2026-11054
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

MIN_SAFE = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def get_windows_version():
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd([
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path}').VersionInfo.ProductVersion"
            ])
            if out:
                v = parse_version(out)
                if v:
                    return path, v
            out = run_cmd([path, '--version'])
            if out:
                v = parse_version(out)
                if v:
                    return path, v
    return None, None


def get_macos_version():
    app = '/Applications/Google Chrome.app'
    plist = Path(app) / 'Contents' / 'Info.plist'
    if plist.exists():
        out = run_cmd(['/usr/bin/defaults', 'read', str(plist), 'CFBundleShortVersionString'])
        if out:
            v = parse_version(out)
            if v:
                return app, v
    bin_path = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(bin_path):
        out = run_cmd([bin_path, '--version'])
        if out:
            v = parse_version(out)
            if v:
                return bin_path, v
    return None, None


def get_linux_version():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        if out:
            v = parse_version(out)
            if v:
                return ' '.join(cmd[:-1]), v
    paths = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
        '/usr/bin/chromium-browser',
        '/usr/bin/chromium',
    ]
    for path in paths:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            if out:
                v = parse_version(out)
                if v:
                    return path, v
    return None, None


def main():
    system = platform.system().lower()
    source = None
    version = None

    if 'windows' in system:
        source, version = get_windows_version()
    elif 'darwin' in system:
        source, version = get_macos_version()
    elif 'linux' in system:
        source, version = get_linux_version()
    else:
        print('UNKNOWN - unsupported operating system')
        sys.exit(2)

    if not version:
        print('UNKNOWN - Google Chrome version could not be determined')
        sys.exit(2)

    verdict = 'PATCHED' if version >= MIN_SAFE else 'VULNERABLE'
    print(f'{verdict} - detected version {version_to_str(version)} from {source}; minimum safe version is {version_to_str(MIN_SAFE)}')
    sys.exit(0 if verdict == 'PATCHED' else 1)


if __name__ == '__main__':
    main()