Out of bounds read in Chromecast in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-11140 local exposure check
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

TARGET = (149, 0, 7827, 53)

def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())

def cmp_ver(a, b):
    return (a > b) - (a < b)

def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        return None
    return None

def windows_candidates():
    paths = []
    for base in [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]:
        if not base:
            continue
        paths.extend([
            os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(base, 'Chromium', 'Application', 'chrome.exe'),
            os.path.join(base, 'Microsoft', 'Edge', 'Application', 'msedge.exe'),
        ])
    return [p for p in paths if p and os.path.exists(p)]

def windows_file_version(path):
    ps = [
        'powershell', '-NoProfile', '-Command',
        f"(Get-Item '{path.replace("'", "''")}').VersionInfo.ProductVersion"
    ]
    return run(ps)

def unix_candidates():
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'microsoft-edge', 'microsoft-edge-stable']
    found = []
    for n in names:
        p = shutil.which(n)
        if p:
            found.append(p)
    extra = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium'
    ]
    for p in extra:
        if os.path.exists(p):
            found.append(p)
    return list(dict.fromkeys(found))

def binary_version(path):
    out = run([path, '--version'])
    if out:
        return out
    return None

def assess_versions(version_map):
    assessed = []
    vulnerable = []
    patched = []
    for name, verstr in version_map.items():
        ver = parse_ver(verstr)
        if not ver:
            continue
        assessed.append((name, verstr, ver))
        if cmp_ver(ver, TARGET) < 0:
            vulnerable.append((name, verstr))
        else:
            patched.append((name, verstr))
    return assessed, vulnerable, patched

def main():
    system = platform.system().lower()
    versions = {}

    if 'windows' in system:
        for path in windows_candidates():
            ver = windows_file_version(path)
            if ver:
                versions[path] = ver
    else:
        for path in unix_candidates():
            ver = binary_version(path)
            if ver:
                versions[path] = ver

    assessed, vulnerable, patched = assess_versions(versions)

    if vulnerable:
        print('VULNERABLE')
        for name, ver in vulnerable:
            print(f'{name}: {ver}')
        sys.exit(1)

    if patched:
        print('PATCHED')
        for name, ver in patched:
            print(f'{name}: {ver}')
        sys.exit(0)

    print('UNKNOWN')
    print('No supported Chrome/Chromium executable found or version could not be parsed.')
    sys.exit(2)

if __name__ == '__main__':
    main()