Google Chrome Codecs improper input validation

#!/usr/bin/env python3
# check_chrome_149.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

TARGETS = {
    'Windows': '149.0.7827.54',
    'Darwin': '149.0.7827.54',
    'Linux': '149.0.7827.53',
}

LABELS = {
    'Windows': 'Google Chrome',
    'Darwin': 'Google Chrome',
    'Linux': 'google-chrome',
}

def parse_version(text):
    m = re.search(r'(\d+\.\d+\.\d+\.\d+)', text)
    return m.group(1) if m else None


def ver_tuple(v):
    return tuple(int(x) for x in v.split('.'))


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
        return None
    except Exception:
        return None


def get_version_windows():
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in candidates:
        if os.path.exists(path):
            ps = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(ps)
            v = parse_version(out or '')
            if v:
                return path, v
    return None, None


def get_version_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out or '')
            if v:
                return path, v
    return None, None


def get_version_linux():
    candidates = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    for bin_name in candidates:
        resolved = which(bin_name)
        if resolved:
            out = run_cmd([resolved, '--version'])
            v = parse_version(out or '')
            if v:
                return resolved, v
    return None, None


def main():
    os_name = platform.system()
    target = TARGETS.get(os_name)
    if not target:
        print('UNKNOWN: Unsupported OS for this check')
        sys.exit(2)

    if os_name == 'Windows':
        path, version = get_version_windows()
    elif os_name == 'Darwin':
        path, version = get_version_macos()
    else:
        path, version = get_version_linux()

    if not version:
        print('UNKNOWN: Chrome not found or version unreadable')
        sys.exit(2)

    if ver_tuple(version) >= ver_tuple(target):
        print(f'PATCHED: {LABELS[os_name]} {version} at {path} (fixed threshold {target})')
        sys.exit(0)
    else:
        print(f'VULNERABLE: {LABELS[os_name]} {version} at {path} (requires >= {target})')
        sys.exit(1)

if __name__ == '__main__':
    main()