Google Chrome for Windows Chromoting input validation flaw

# check-chrome-cve-2026-11070.ps1

# Purpose: Determine whether a Windows host is vulnerable to CVE-2026-11070 based on installed Chrome version.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'
$MinimumSafeVersion = [version]'149.0.7827.53'

function Compare-Version {
    param(
        [Parameter(Mandatory=$true)][string]$VersionString,
        [Parameter(Mandatory=$true)][version]$MinimumVersion
    )
    try {
        $v = [version]$VersionString
        return ($v -ge $MinimumVersion)
    } catch {
        return $null
    }
}

function Get-ChromeCandidates {
    $paths = New-Object System.Collections.Generic.List[string]

    $machinePaths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"
    )

    foreach ($p in $machinePaths) {
        if ($p -and (Test-Path $p)) { [void]$paths.Add($p) }
    }

    $userRoot = 'C:\Users'
    if (Test-Path $userRoot) {
        Get-ChildItem -Path $userRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object {
            $userChrome = Join-Path $_.FullName 'AppData\Local\Google\Chrome\Application\chrome.exe'
            if (Test-Path $userChrome) { [void]$paths.Add($userChrome) }
        }
    }

    return $paths | Sort-Object -Unique
}

try {
    $candidates = Get-ChromeCandidates

    if (-not $candidates -or $candidates.Count -eq 0) {
        Write-Output 'UNKNOWN: Google Chrome not found in standard machine-wide or per-user paths.'
        exit 2
    }

    $results = @()
    foreach ($path in $candidates) {
        try {
            $item = Get-Item $path
            $versionString = $item.VersionInfo.ProductVersion
            if (-not $versionString) { $versionString = $item.VersionInfo.FileVersion }

            $isSafe = Compare-Version -VersionString $versionString -MinimumVersion $MinimumSafeVersion

            $results += [pscustomobject]@{
                Path       = $path
                Version    = $versionString
                IsPatched  = $isSafe
            }
        } catch {
            $results += [pscustomobject]@{
                Path       = $path
                Version    = 'UNKNOWN'
                IsPatched  = $null
            }
        }
    }

    $vuln = $results | Where-Object { $_.IsPatched -eq $false }
    $unknown = $results | Where-Object { $_.IsPatched -eq $null }

    if ($vuln.Count -gt 0) {
        Write-Output 'VULNERABLE'
        $results | ForEach-Object {
            Write-Output ("{0} :: Version={1} :: Patched={2}" -f $_.Path, $_.Version, $_.IsPatched)
        }
        exit 1
    }

    if ($unknown.Count -gt 0 -and ($results | Where-Object { $_.IsPatched -eq $true }).Count -eq 0) {
        Write-Output 'UNKNOWN'
        $results | ForEach-Object {
            Write-Output ("{0} :: Version={1} :: Patched={2}" -f $_.Path, $_.Version, $_.IsPatched)
        }
        exit 2
    }

    Write-Output 'PATCHED'
    $results | ForEach-Object {
        Write-Output ("{0} :: Version={1} :: Patched={2}" -f $_.Path, $_.Version, $_.IsPatched)
    }
    exit 0

} catch {
    Write-Output ('UNKNOWN: error while checking Chrome version - ' + $_.Exception.Message)
    exit 3
}