Google Chrome Windows Installer DLL Hijacking Privilege Escalation

# Check-CVE-2026-11103.ps1
# Checks if Google Chrome on Windows is patched against CVE-2026-11103
# (Installer privilege escalation via malicious file)
# Fixed in: 149.0.7827.53
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'
$chromeFound = $false

# Check common Chrome installation paths
$paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

foreach ($p in $paths) {
    if (Test-Path $p) {
        $chromeFound = $true
        $ver = [version](Get-ItemProperty $p).VersionInfo.FileVersion
        if ($ver -ge $fixedVersion) {
            Write-Host "PATCHED - Chrome $ver is installed (fixed in $fixedVersion)" -ForegroundColor Green
            exit 0
        } else {
            Write-Host "VULNERABLE - Chrome $ver is below fixed version $fixedVersion" -ForegroundColor Red
            # Bonus: check for stale installers in Downloads
            $downloads = Join-Path $env:USERPROFILE 'Downloads'
            $staleInstallers = Get-ChildItem -Path $downloads -Filter 'Chrome*Setup*.exe' -ErrorAction SilentlyContinue
            if ($staleInstallers) {
                Write-Host "WARNING - Stale Chrome installer(s) found in Downloads:" -ForegroundColor Yellow
                $staleInstallers | ForEach-Object { Write-Host "  $_" -ForegroundColor Yellow }
            }
            exit 1
        }
    }
}

if (-not $chromeFound) {
    # Try registry
    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome'
    )
    foreach ($rp in $regPaths) {
        $reg = Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue
        if ($reg -and $reg.Version) {
            $ver = [version]$reg.Version
            if ($ver -ge $fixedVersion) {
                Write-Host "PATCHED - Chrome $ver found in registry (fixed in $fixedVersion)" -ForegroundColor Green
                exit 0
            } else {
                Write-Host "VULNERABLE - Chrome $ver found in registry, below $fixedVersion" -ForegroundColor Red
                exit 1
            }
        }
    }
}

Write-Host "UNKNOWN - Google Chrome not detected on this system" -ForegroundColor Gray
exit 2