Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-11120 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_versions():
    versions = []
    candidates = [
        r'C:\Program Files\Google\Chrome\Application\chrome.exe',
        r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
        os.path.expandvars(r'%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd([
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path}').VersionInfo.ProductVersion"
            ])
            v = parse_version(out)
            if v:
                versions.append((path, v))

    reg_paths = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon',
    ]
    for key in reg_paths:
        out = run_cmd(['reg', 'query', key, '/v', 'version'])
        v = parse_version(out)
        if v:
            versions.append((key, v))
    return versions


def mac_versions():
    versions = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                versions.append((path, v))
    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        out = run_cmd(['/usr/bin/defaults', 'read', plist.replace('/Info.plist', ''), 'CFBundleShortVersionString'])
        v = parse_version(out)
        if v:
            versions.append((plist, v))
    return versions


def linux_versions():
    versions = []
    candidates = [
        'google-chrome',
        'google-chrome-stable',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        'chromium',
        'chromium-browser',
    ]
    seen = set()
    for cmd in candidates:
        if cmd in seen:
            continue
        seen.add(cmd)
        out = run_cmd([cmd, '--version'])
        v = parse_version(out)
        if v:
            versions.append((cmd, v))
    return versions


def main():
    system = platform.system().lower()
    found = []

    if 'windows' in system:
        found = windows_versions()
    elif 'darwin' in system:
        found = mac_versions()
    else:
        found = linux_versions()

    if not found:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    # Deduplicate by version string while preserving evidence
    unique = []
    seen = set()
    for source, ver in found:
        key = (source, ver)
        if key not in seen:
            unique.append((source, ver))
            seen.add(key)

    vulnerable = []
    patched = []
    for source, ver in unique:
        if cmp_ver(ver, THRESHOLD) < 0:
            vulnerable.append((source, ver))
        else:
            patched.append((source, ver))

    if vulnerable:
        detail = '; '.join([f'{src}={".".join(map(str, ver))}' for src, ver in vulnerable])
        print(f'VULNERABLE: {detail}')
        sys.exit(1)
    else:
        detail = '; '.join([f'{src}={".".join(map(str, ver))}' for src, ver in patched])
        print(f'PATCHED: {detail}')
        sys.exit(0)


if __name__ == '__main__':
    main()