Google Chrome on Android GPU integer overflow leading to potential sandbox escape

#!/usr/bin/env bash
# check_chrome_android.sh
# Verifies whether Google Chrome on an attached Android device is below 149.0.7827.53.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"
PACKAGE="com.android.chrome"
SERIAL="${1:-}"

adb_cmd() {
  if [ -n "$SERIAL" ]; then
    adb -s "$SERIAL" "$@"
  else
    adb "$@"
  fi
}

version_lt() {
  # returns 0 if $1 < $2
  local IFS=.
  local i
  local -a a=($1) b=($2)
  local len=${#a[@]}
  if [ ${#b[@]} -gt $len ]; then len=${#b[@]}; fi
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    if ((10#$ai < 10#$bi)); then
      return 0
    elif ((10#$ai > 10#$bi)); then
      return 1
    fi
  done
  return 1
}

# Basic device check
if ! adb_cmd get-state >/dev/null 2>&1; then
  echo "UNKNOWN - no accessible Android device via adb"
  exit 2
fi

# Try several methods because OEM builds differ
VERSION="$(adb_cmd shell dumpsys package "$PACKAGE" 2>/dev/null | tr -d '\r' | sed -n 's/.*versionName=//p' | head -n1)"
if [ -z "$VERSION" ]; then
  VERSION="$(adb_cmd shell cmd package list packages -f "$PACKAGE" 2>/dev/null | tr -d '\r' | sed -n 's/.*versionName=//p' | head -n1)"
fi
if [ -z "$VERSION" ]; then
  VERSION="$(adb_cmd shell pm dump "$PACKAGE" 2>/dev/null | tr -d '\r' | sed -n 's/.*versionName=//p' | head -n1)"
fi

if [ -z "$VERSION" ]; then
  # Final fallback: try package manager path presence to distinguish absent vs unreadable
  if adb_cmd shell pm path "$PACKAGE" >/dev/null 2>&1; then
    echo "UNKNOWN - Chrome installed but version could not be read"
  else
    echo "UNKNOWN - Chrome is not installed or package metadata is inaccessible"
  fi
  exit 2
fi

if version_lt "$VERSION" "$FIXED_VERSION"; then
  echo "VULNERABLE - $PACKAGE version $VERSION is below fixed $FIXED_VERSION"
  exit 1
else
  echo "PATCHED - $PACKAGE version $VERSION is at or above fixed $FIXED_VERSION"
  exit 0
fi