Use after free in WebGL in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11073.py
# Defensive version check for CVE-2026-11073 (Chrome WebGL UAF)
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

Version = Tuple[int, int, int, int]


def parse_version(text: str) -> Optional[Version]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd: List[str]) -> str:
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        return (p.stdout or '') + (p.stderr or '')
    except Exception:
        return ''


def version_ge(a: Version, b: Version) -> bool:
    return a >= b


def is_patched(ver: Version, system_name: str) -> bool:
    # Stable fixed baseline for all desktop platforms
    stable_fix = (149, 0, 7827, 53)
    # Windows/macOS Extended Stable backport noted by Google
    ext_fix = (148, 0, 7778, 254)

    if system_name in ('Windows', 'Darwin'):
        if ver[0] == 148 and ver[1] == 0 and ver[2] == 7778:
            return version_ge(ver, ext_fix)
        return version_ge(ver, stable_fix)
    else:
        # Linux advisory lists stable fix only
        return version_ge(ver, stable_fix)


def detect_linux() -> List[Tuple[str, Version]]:
    found = []
    candidates = ['google-chrome', 'google-chrome-stable', 'chromium-browser', 'chromium']
    for c in candidates:
        path = shutil.which(c)
        if not path:
            continue
        out = run_cmd([path, '--version'])
        ver = parse_version(out)
        if ver:
            found.append((path, ver))
    return found


def detect_macos() -> List[Tuple[str, Version]]:
    found = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary'
    ]
    for path in candidates:
        if not os.path.exists(path):
            continue
        out = run_cmd([path, '--version'])
        ver = parse_version(out)
        if ver:
            found.append((path, ver))
    return found


def detect_windows() -> List[Tuple[str, Version]]:
    found = []

    # Common executable paths
    envs = [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData')
    ]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
        r'Chromium\Application\chrome.exe'
    ]
    for base in envs:
        if not base:
            continue
        for suf in suffixes:
            path = os.path.join(base, *suf.split('\\'))
            if os.path.exists(path):
                out = run_cmd([path, '--version'])
                ver = parse_version(out)
                if ver:
                    found.append((path, ver))

    # Registry fallback: BLBeacon version key
    reg_keys = [
        r'HKLM\SOFTWARE\Google\Chrome\BLBeacon',
        r'HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon'
    ]
    for key in reg_keys:
        out = run_cmd(['reg', 'query', key, '/v', 'version'])
        ver = parse_version(out)
        if ver:
            found.append((key, ver))

    # Deduplicate
    uniq = {}
    for src, ver in found:
        uniq[src] = ver
    return list(uniq.items())


def main() -> int:
    system_name = platform.system()
    detections: List[Tuple[str, Version]] = []

    if system_name == 'Linux':
        detections = detect_linux()
    elif system_name == 'Darwin':
        detections = detect_macos()
    elif system_name == 'Windows':
        detections = detect_windows()
    else:
        print(f'UNKNOWN: unsupported platform {system_name}')
        return 2

    if not detections:
        print('UNKNOWN: Chrome/Chromium version not found')
        return 2

    vulnerable = []
    patched = []
    for src, ver in detections:
        if is_patched(ver, system_name):
            patched.append((src, ver))
        else:
            vulnerable.append((src, ver))

    print('Detected versions:')
    for src, ver in detections:
        print(f'  {src}: {".".join(map(str, ver))}')

    if vulnerable:
        print('VULNERABLE')
        return 1

    if patched:
        print('PATCHED')
        return 0

    print('UNKNOWN')
    return 2


if __name__ == '__main__':
    sys.exit(main())