Google Chrome Password Manager cross-origin data leak

#!/usr/bin/env python3
# Check for CVE-2026-11083 exposure by inspecting local Google Chrome version.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def try_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def windows_version():
    candidates = [
        [r'C:\Program Files\Google\Chrome\Application\chrome.exe', '--version'],
        [r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe', '--version'],
    ]
    for cmd in candidates:
        if os.path.exists(cmd[0]):
            v = try_cmd(cmd)
            if v:
                return v, cmd[0]

    # Registry fallback
    try:
        import winreg  # type: ignore
        reg_paths = [
            (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon'),
        ]
        for hive, path in reg_paths:
            try:
                key = winreg.OpenKey(hive, path)
                version, _ = winreg.QueryValueEx(key, 'version')
                v = parse_version(str(version))
                if v:
                    return v, f'registry:{path}'
            except OSError:
                continue
    except Exception:
        pass

    return None, None


def mac_version():
    candidates = [
        ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '--version'],
        [os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'), '--version'],
    ]
    for cmd in candidates:
        if os.path.exists(cmd[0]):
            v = try_cmd(cmd)
            if v:
                return v, cmd[0]
    return None, None


def linux_version():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
        ['/usr/bin/google-chrome', '--version'],
        ['/usr/bin/google-chrome-stable', '--version'],
    ]
    for cmd in candidates:
        exe = cmd[0]
        if '/' in exe and not os.path.exists(exe):
            continue
        v = try_cmd(cmd)
        if v:
            return v, exe
    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'windows' in system:
        version, source = windows_version()
    elif 'darwin' in system:
        version, source = mac_version()
    else:
        version, source = linux_version()

    if not version:
        print('UNKNOWN - Google Chrome version not found')
        sys.exit(2)

    current = '.'.join(map(str, version))
    fixed = '.'.join(map(str, THRESHOLD))

    if cmp_version(version, THRESHOLD) < 0:
        print(f'VULNERABLE - Google Chrome {current} detected via {source}; fixed version is {fixed} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - Google Chrome {current} detected via {source}; meets fixed version threshold {fixed}')
        sys.exit(0)


if __name__ == '__main__':
    main()