Chrome Isolated Web Apps Inappropriate Implementation Leading to Sandboxed Code Execution

#Requires -Version 5.1
<#
.SYNOPSIS
    Check whether the installed Google Chrome version is vulnerable to CVE-2026-11102.
.DESCRIPTION
    Reads Chrome version from the registry (HKLM and HKCU) and compares against
    the fixed version 149.0.7827.53. Also checks if Isolated Web Apps are
    enabled via enterprise policy.
.OUTPUTS
    VULNERABLE / PATCHED / UNKNOWN
#>

$FixedVersion = [version]'149.0.7827.53'
$ChromePaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
)
$VersionKeys = @(
    'HKLM:\SOFTWARE\Google\Chrome\BLBeacon',
    'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
    'HKCU:\SOFTWARE\Google\Chrome\BLBeacon'
)
$IWAPolicyKey = 'HKLM:\SOFTWARE\Policies\Google\Chrome'

$ChromeInstalled = $false
$InstalledVersion = $null

foreach ($key in $VersionKeys) {
    if (Test-Path $key) {
        $ver = (Get-ItemProperty -Path $key -Name 'version' -ErrorAction SilentlyContinue).version
        if ($ver) {
            $ChromeInstalled = $true
            try { $InstalledVersion = [version]$ver } catch { }
            break
        }
    }
}

if (-not $ChromeInstalled) {
    # Fallback: try chrome.exe --version
    $chromePath = (Get-Command chrome.exe -ErrorAction SilentlyContinue).Source
    if ($chromePath) {
        $ChromeInstalled = $true
        $verStr = (& $chromePath --version 2>$null) -replace '[^0-9.]',''
        try { $InstalledVersion = [version]$verStr } catch { }
    }
}

if (-not $ChromeInstalled) {
    Write-Output 'UNKNOWN - Google Chrome not detected on this system.'
    exit 2
}

if (-not $InstalledVersion) {
    Write-Output 'UNKNOWN - Chrome installed but version could not be determined.'
    exit 2
}

# Check IWA policy
$IWAEnabled = $null
if (Test-Path $IWAPolicyKey) {
    $iwaPolicy = (Get-ItemProperty -Path $IWAPolicyKey -Name 'IsolatedWebAppsAllowed' -ErrorAction SilentlyContinue).IsolatedWebAppsAllowed
    if ($null -ne $iwaPolicy) { $IWAEnabled = [bool]$iwaPolicy }
}

$iwaNote = if ($IWAEnabled -eq $true) { ' [IWA ENABLED via policy]' }
           elseif ($IWAEnabled -eq $false) { ' [IWA DISABLED via policy - not exploitable]' }
           else { ' [IWA policy not set - default: disabled for non-partners]' }

if ($InstalledVersion -lt $FixedVersion) {
    Write-Output "VULNERABLE - Chrome $InstalledVersion < $FixedVersion$iwaNote"
    exit 1
} else {
    Write-Output "PATCHED - Chrome $InstalledVersion >= $FixedVersion$iwaNote"
    exit 0
}