Type Confusion in CSS in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_11076.py
# Verifies whether installed Google Chrome is vulnerable to CVE-2026-11076.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_and_parse(cmd):
    try:
        proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        combined = (proc.stdout or '') + '\n' + (proc.stderr or '')
        return parse_version(combined)
    except Exception:
        return None


def windows_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]

    for path in candidates:
        if path and os.path.exists(path):
            v = run_and_parse([path, '--version'])
            if v:
                return v

    # Fallback to WMIC/PowerShell-friendly file metadata via Python only is messy; stick to executable check.
    return None


def macos_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            v = run_and_parse([path, '--version'])
            if v:
                return v
    return None


def linux_version() -> Optional[Tuple[int, int, int, int]]:
    commands = ['google-chrome', 'google-chrome-stable', 'chrome']
    for cmd in commands:
        full = shutil.which(cmd)
        if full:
            v = run_and_parse([full, '--version'])
            if v:
                return v

    # Package fallback for Debian/Ubuntu family
    if shutil.which('dpkg-query'):
        try:
            proc = subprocess.run(['dpkg-query', '-W', '-f=${Version}', 'google-chrome-stable'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
            v = parse_version(proc.stdout or '')
            if v:
                return v
        except Exception:
            pass

    # Package fallback for RPM family
    if shutil.which('rpm'):
        try:
            proc = subprocess.run(['rpm', '-q', '--qf', '%{VERSION}', 'google-chrome-stable'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
            v = parse_version(proc.stdout or '')
            if v:
                return v
        except Exception:
            pass

    return None


def compare_versions(found: Tuple[int, int, int, int], fixed: Tuple[int, int, int, int]) -> int:
    if found < fixed:
        return -1
    if found > fixed:
        return 1
    return 0


def main():
    system = platform.system().lower()
    version = None

    if 'windows' in system:
        version = windows_version()
    elif 'darwin' in system:
        version = macos_version()
    elif 'linux' in system:
        version = linux_version()
    else:
        print('UNKNOWN: unsupported platform {}'.format(platform.system()))
        sys.exit(2)

    if not version:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    cmp_result = compare_versions(version, FIXED_VERSION)
    version_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in FIXED_VERSION)

    if cmp_result < 0:
        print(f'VULNERABLE: installed Google Chrome {version_str} is older than fixed {fixed_str}')
        sys.exit(1)
    else:
        print(f'PATCHED: installed Google Chrome {version_str} is at or newer than fixed {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()