Google Chrome Forms side-channel cross-origin data leak

#!/usr/bin/env python3
# check_chrome_cve_2026_11153.py
# Detects whether locally installed Google Chrome is below 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def get_windows_version():
    candidates = [
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
        os.path.expandvars(r"%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            try:
                cmd = [
                    'powershell', '-NoProfile', '-Command',
                    f"(Get-Item '{path}').VersionInfo.ProductVersion"
                ]
                out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True, timeout=10).strip()
                ver = parse_version(out)
                if ver:
                    return path, ver
            except Exception:
                continue
    return None, None


def get_macos_version():
    candidates = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for path in candidates:
        if os.path.exists(path):
            try:
                out = subprocess.check_output([path, '--version'], stderr=subprocess.DEVNULL, text=True, timeout=10).strip()
                ver = parse_version(out)
                if ver:
                    return path, ver
            except Exception:
                continue
    return None, None


def get_linux_version():
    candidates = [
        which('google-chrome'),
        which('google-chrome-stable'),
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    seen = set()
    for path in candidates:
        if not path or path in seen:
            continue
        seen.add(path)
        if os.path.exists(path):
            try:
                out = subprocess.check_output([path, '--version'], stderr=subprocess.DEVNULL, text=True, timeout=10).strip()
                ver = parse_version(out)
                if ver:
                    return path, ver
            except Exception:
                continue
    return None, None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        path, ver = get_windows_version()
    elif 'darwin' in system:
        path, ver = get_macos_version()
    elif 'linux' in system:
        path, ver = get_linux_version()
    else:
        print('UNKNOWN: unsupported OS for this checker')
        sys.exit(2)

    if not ver:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    installed = '.'.join(map(str, ver))
    fixed = '.'.join(map(str, THRESHOLD))

    if cmp_ver(ver, THRESHOLD) < 0:
        print(f'VULNERABLE: Chrome {installed} found at {path}; fixed version is {fixed} or later')
        sys.exit(1)
    else:
        print(f'PATCHED: Chrome {installed} found at {path}; meets fixed version {fixed} or later')
        sys.exit(0)


if __name__ == '__main__':
    main()