Use after free in Media in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11144.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

SAFE_FLOOR = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v: Tuple[int, int, int, int]) -> str:
    return '.'.join(str(x) for x in v)


def candidate_paths() -> List[str]:
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        envs = [
            os.environ.get('ProgramFiles'),
            os.environ.get('ProgramFiles(x86)'),
            os.environ.get('LocalAppData')
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for suf in suffixes:
                    paths.append(os.path.join(base, suf))
    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium'
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            found = shutil.which(name)
            if found:
                paths.append(found)
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ])

    seen = []
    for p in paths:
        if p and p not in seen:
            seen.append(p)
    return seen


def get_version_from_binary(path: str) -> Optional[Tuple[int, int, int, int]]:
    if not os.path.exists(path):
        return None
    commands = [
        [path, '--version'],
        [path, '-version']
    ]
    for cmd in commands:
        try:
            out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
            v = parse_version(out)
            if v:
                return v
        except Exception:
            pass
    return None


def main() -> int:
    parser = argparse.ArgumentParser(description='Check Chrome version for CVE-2026-11144 exposure')
    parser.add_argument('--path', help='Explicit path to Chrome/Chromium binary')
    args = parser.parse_args()

    paths = [args.path] if args.path else candidate_paths()
    checked = []

    for path in paths:
        if not path:
            continue
        checked.append(path)
        v = get_version_from_binary(path)
        if v is None:
            continue

        if v >= SAFE_FLOOR:
            print(f'PATCHED: {path} version {version_to_str(v)} >= {version_to_str(SAFE_FLOOR)}')
            return 0
        else:
            print(f'VULNERABLE: {path} version {version_to_str(v)} < {version_to_str(SAFE_FLOOR)}')
            return 1

    if checked:
        print('UNKNOWN: Chrome binary found but version could not be determined from: ' + ', '.join(checked))
    else:
        print('UNKNOWN: No Chrome/Chromium binary found in common locations; supply --path to check a specific install')
    return 2


if __name__ == '__main__':
    sys.exit(main())