Inappropriate implementation in GPU in Google Chrome on Android prior to 149

#!/usr/bin/env python3
# chrome_android_cve_check.py
# Check Android Chrome version for CVE-2026-11119 exposure.
# Exit codes:
#   0 = all checked targets PATCHED
#   1 = at least one checked target VULNERABLE
#   2 = UNKNOWN / operational error / no targets

import argparse
import re
import shutil
import subprocess
import sys

FIXED_VERSION = "149.0.7827.59"  # Android stable release carrying the fix
PACKAGE = "com.android.chrome"


def parse_version(text):
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_versions(a, b):
    return (a > b) - (a < b)


def run(cmd):
    return subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)


def adb_base(serial=None):
    base = ["adb"]
    if serial:
        base += ["-s", serial]
    return base


def get_devices():
    p = run(["adb", "devices"])
    if p.returncode != 0:
        return None, p.stderr.strip() or p.stdout.strip()
    devices = []
    for line in p.stdout.splitlines()[1:]:
        line = line.strip()
        if not line:
            continue
        parts = line.split()
        if len(parts) >= 2 and parts[1] == "device":
            devices.append(parts[0])
    return devices, ""


def get_chrome_version(serial):
    cmd = adb_base(serial) + ["shell", "dumpsys", "package", PACKAGE]
    p = run(cmd)
    if p.returncode != 0:
        return None, f"adb command failed: {p.stderr.strip() or p.stdout.strip()}"

    # Look for versionName in dumpsys output
    m = re.search(r"versionName=([^\s]+)", p.stdout)
    if m:
        return m.group(1).strip(), ""

    # Fallback: package may be missing or output restricted
    if "Unable to find package" in p.stdout or "Unable to find package" in p.stderr:
        return None, f"package {PACKAGE} not installed"

    return None, "could not determine versionName"


def check_device(serial):
    version_str, err = get_chrome_version(serial)
    if version_str is None:
        return {"serial": serial, "status": "UNKNOWN", "detail": err}

    current = parse_version(version_str)
    fixed = parse_version(FIXED_VERSION)
    if current is None or fixed is None:
        return {"serial": serial, "status": "UNKNOWN", "detail": f"unparseable version: {version_str}"}

    if compare_versions(current, fixed) >= 0:
        return {"serial": serial, "status": "PATCHED", "detail": version_str}
    return {"serial": serial, "status": "VULNERABLE", "detail": version_str}


def main():
    parser = argparse.ArgumentParser(description="Check Android Chrome for CVE-2026-11119")
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument("--device", help="single adb device serial")
    group.add_argument("--all", action="store_true", help="check all connected adb devices")
    args = parser.parse_args()

    if shutil.which("adb") is None:
        print("UNKNOWN - adb not found in PATH")
        sys.exit(2)

    if args.device:
        targets = [args.device]
    else:
        targets, err = get_devices()
        if targets is None:
            print(f"UNKNOWN - failed to enumerate devices: {err}")
            sys.exit(2)
        if not targets:
            print("UNKNOWN - no adb devices connected")
            sys.exit(2)

    results = [check_device(t) for t in targets]

    any_vuln = False
    any_unknown = False
    for r in results:
        print(f"{r['serial']}: {r['status']} - {r['detail']}")
        if r["status"] == "VULNERABLE":
            any_vuln = True
        elif r["status"] == "UNKNOWN":
            any_unknown = True

    if any_vuln:
        sys.exit(1)
    if any_unknown:
        sys.exit(2)
    sys.exit(0)


if __name__ == "__main__":
    main()