Inappropriate implementation in Downloads in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-11107 Chrome version checker
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import subprocess
import sys
from shutil import which

PATCHED_MIN = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_ver(s):
    if not s:
        return None
    m = VERSION_RE.search(s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(v):
    return '.'.join(str(x) for x in v)


def is_patched(v):
    return v >= PATCHED_MIN


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_paths():
    system = platform.system().lower()
    paths = []

    if 'windows' in system:
        envs = [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]
        rels = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for rel in rels:
                    paths.append(os.path.join(base, rel))
    elif 'darwin' in system:
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium'
        ])
    else:
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ])

    return [p for p in paths if p and os.path.exists(p)]


def detect_version_from_path(path):
    out = run_cmd([path, '--version'])
    return parse_ver(out), out.strip()


def detect_version_auto():
    for exe in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        p = which(exe)
        if p:
            v, raw = detect_version_from_path(p)
            if v:
                return p, v, raw

    for p in candidate_paths():
        v, raw = detect_version_from_path(p)
        if v:
            return p, v, raw

    return None, None, ''


def main():
    ap = argparse.ArgumentParser(description='Check whether installed Chrome/Chromium is vulnerable to CVE-2026-11107.')
    ap.add_argument('--version', help='Version string to evaluate directly, e.g. 149.0.7827.52')
    ap.add_argument('--path', help='Path to browser executable, e.g. C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe')
    args = ap.parse_args()

    if args.version:
        v = parse_ver(args.version)
        if not v:
            print('UNKNOWN - Could not parse supplied version string')
            sys.exit(2)
        if is_patched(v):
            print(f'PATCHED - Version {ver_to_str(v)} is >= {ver_to_str(PATCHED_MIN)}')
            sys.exit(0)
        else:
            print(f'VULNERABLE - Version {ver_to_str(v)} is < {ver_to_str(PATCHED_MIN)}')
            sys.exit(1)

    if args.path:
        if not os.path.exists(args.path):
            print(f'UNKNOWN - File not found: {args.path}')
            sys.exit(2)
        v, raw = detect_version_from_path(args.path)
        if not v:
            print(f'UNKNOWN - Could not determine version from {args.path}')
            sys.exit(2)
        if is_patched(v):
            print(f'PATCHED - {args.path} reports {raw}')
            sys.exit(0)
        else:
            print(f'VULNERABLE - {args.path} reports {raw}')
            sys.exit(1)

    path, v, raw = detect_version_auto()
    if not v:
        print('UNKNOWN - Could not automatically locate Chrome/Chromium or parse its version')
        sys.exit(2)

    if is_patched(v):
        print(f'PATCHED - {path} reports {raw}')
        sys.exit(0)
    else:
        print(f'VULNERABLE - {path} reports {raw}')
        sys.exit(1)


if __name__ == '__main__':
    main()