Google Chrome for Android Payments cross-origin data leak

#!/usr/bin/env bash
# check_chrome_android_cve_2026_11148.sh
# Checks whether Google Chrome on an attached Android device is below 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/dependency error

set -u

FIXED_VERSION="149.0.7827.53"
PACKAGE="com.android.chrome"

usage() {
  echo "Usage: $0 <adb-serial>"
  exit 3
}

if [ $# -ne 1 ]; then
  usage
fi

SERIAL="$1"

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN - adb not found in PATH"
  exit 3
fi

adb -s "$SERIAL" get-state >/dev/null 2>&1
if [ $? -ne 0 ]; then
  echo "UNKNOWN - device not reachable via adb: $SERIAL"
  exit 2
fi

VERSION_LINE=$(adb -s "$SERIAL" shell dumpsys package "$PACKAGE" 2>/dev/null | tr -d '\r' | grep -m1 'versionName=')
if [ -z "$VERSION_LINE" ]; then
  echo "UNKNOWN - could not read Chrome package metadata (package missing or restricted)"
  exit 2
fi

INSTALLED_VERSION=${VERSION_LINE#*=}
INSTALLED_VERSION=$(echo "$INSTALLED_VERSION" | awk '{print $1}')

normalize_version() {
  local ver="$1"
  local IFS='.'
  local parts
  read -r -a parts <<< "$ver"
  while [ ${#parts[@]} -lt 4 ]; do
    parts+=(0)
  done
  printf "%d %d %d %d\n" "${parts[0]}" "${parts[1]}" "${parts[2]}" "${parts[3]}"
}

compare_versions() {
  # returns 0 if equal, 1 if first > second, 2 if first < second
  local a b i
  read -r -a a <<< "$(normalize_version "$1")"
  read -r -a b <<< "$(normalize_version "$2")"
  for i in 0 1 2 3; do
    if [ "${a[$i]}" -gt "${b[$i]}" ]; then
      return 1
    fi
    if [ "${a[$i]}" -lt "${b[$i]}" ]; then
      return 2
    fi
  done
  return 0
}

compare_versions "$INSTALLED_VERSION" "$FIXED_VERSION"
CMP=$?

if [ $CMP -eq 2 ]; then
  echo "VULNERABLE - Chrome $INSTALLED_VERSION < $FIXED_VERSION on device $SERIAL"
  exit 1
elif [ $CMP -eq 0 ] || [ $CMP -eq 1 ]; then
  echo "PATCHED - Chrome $INSTALLED_VERSION >= $FIXED_VERSION on device $SERIAL"
  exit 0
else
  echo "UNKNOWN - version comparison failed for $INSTALLED_VERSION"
  exit 2
fi