Bad cast in Dawn in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_11077.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIX_LINUX = (149, 0, 7827, 53)
FIX_WINMAC = (149, 0, 7827, 54)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return None, ''


def candidate_paths_from_arg():
    if '--path' in sys.argv:
        i = sys.argv.index('--path')
        if i + 1 < len(sys.argv):
            return [sys.argv[i + 1]]
    return []


def find_candidates():
    system = platform.system().lower()
    cands = []
    cands.extend(candidate_paths_from_arg())

    if system == 'windows':
        envs = [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]
        rels = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for rel in rels:
                    cands.append(os.path.join(base, rel))
    elif system == 'darwin':
        cands.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            '/Applications/Chromium.app/Contents/MacOS/Chromium'
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            p = shutil.which(name)
            if p:
                cands.append(p)
        cands.extend([
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser'
        ])

    seen = set()
    uniq = []
    for c in cands:
        if c and c not in seen:
            seen.add(c)
            uniq.append(c)
    return uniq


def get_version(path):
    if not os.path.exists(path):
        return None, None
    rc, out = run_cmd([path, '--version'])
    ver = parse_version(out)
    if ver:
        return ver, out
    return None, out


def main():
    system = platform.system().lower()
    fix = FIX_WINMAC if system in ('windows', 'darwin') else FIX_LINUX

    candidates = find_candidates()
    found = []

    for path in candidates:
        ver, raw = get_version(path)
        if ver:
            found.append((path, ver, raw))

    if not found:
        print('UNKNOWN - Chrome/Chromium binary not found or version unreadable')
        sys.exit(2)

    # Evaluate the newest discovered version.
    found.sort(key=lambda x: x[1], reverse=True)
    path, ver, raw = found[0]

    # Treat Chromium family versions conservatively as UNKNOWN unless clearly Google Chrome.
    # The CVE is in Chromium code, but patch availability and branding differ by downstream builds.
    is_chrome = 'chrome' in os.path.basename(path).lower() or 'Google Chrome' in raw

    if not is_chrome:
        print(f'UNKNOWN - Found Chromium-family browser at {path} version {".".join(map(str, ver))}; downstream patch status must be verified separately')
        sys.exit(2)

    if version_lt(ver, fix):
        print(f'VULNERABLE - {path} version {".".join(map(str, ver))} is below fixed version {".".join(map(str, fix))}')
        sys.exit(1)
    else:
        print(f'PATCHED - {path} version {".".join(map(str, ver))} meets or exceeds fixed version {".".join(map(str, fix))}')
        sys.exit(0)


if __name__ == '__main__':
    main()