Use after free in Blink in Google Chrome prior to 149

#!/usr/bin/env python3
# Check for CVE-2026-11059 exposure by local Chrome/Chromium version
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

FIXED = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v: Tuple[int, int, int, int]) -> str:
    return '.'.join(str(x) for x in v)


def run_cmd(cmd: List[str]) -> Optional[str]:
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return None


def candidate_paths() -> List[str]:
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        envs = [
            os.environ.get('PROGRAMFILES'),
            os.environ.get('PROGRAMFILES(X86)'),
            os.environ.get('LOCALAPPDATA'),
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe',
            r'Google\Chrome Beta\Application\chrome.exe',
        ]
        for base in envs:
            if not base:
                continue
            for suf in suffixes:
                p = os.path.join(base, *suf.split('\\'))
                if os.path.exists(p):
                    paths.append(p)
    elif system == 'darwin':
        mac_paths = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        paths.extend([p for p in mac_paths if os.path.exists(p)])
    else:
        bins = [
            'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome'
        ]
        for b in bins:
            p = shutil.which(b)
            if p:
                paths.append(p)
        linux_paths = [
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
        ]
        paths.extend([p for p in linux_paths if os.path.exists(p)])

    # de-dup preserving order
    seen = set()
    uniq = []
    for p in paths:
        if p not in seen:
            uniq.append(p)
            seen.add(p)
    return uniq


def get_version_from_binary(path: str) -> Optional[Tuple[int, int, int, int]]:
    out = run_cmd([path, '--version'])
    if out:
        v = parse_version(out)
        if v:
            return v

    # Fallback for Windows PowerShell file version query
    if platform.system().lower() == 'windows':
        ps = [
            'powershell', '-NoProfile', '-Command',
            f"(Get-Item -LiteralPath '{path}').VersionInfo.ProductVersion"
        ]
        out = run_cmd(ps)
        if out:
            v = parse_version(out)
            if v:
                return v

    return None


def compare(v: Tuple[int, int, int, int], fixed: Tuple[int, int, int, int]) -> int:
    return (v > fixed) - (v < fixed)


def main() -> int:
    paths = candidate_paths()
    if not paths:
        print('UNKNOWN: Chrome/Chromium executable not found')
        return 2

    findings = []
    for p in paths:
        v = get_version_from_binary(p)
        findings.append((p, v))

    known = [(p, v) for p, v in findings if v is not None]
    if not known:
        print('UNKNOWN: Found browser binaries but could not determine version')
        return 2

    vulnerable = []
    patched = []
    for p, v in known:
        if compare(v, FIXED) < 0:
            vulnerable.append((p, v))
        else:
            patched.append((p, v))

    if vulnerable:
        details = '; '.join(f'{p}={version_str(v)}' for p, v in vulnerable)
        print(f'VULNERABLE: fixed version is {version_str(FIXED)}; found {details}')
        return 1

    details = '; '.join(f'{p}={version_str(v)}' for p, v in patched)
    print(f'PATCHED: fixed version is {version_str(FIXED)}; found {details}')
    return 0


if __name__ == '__main__':
    sys.exit(main())