Script injection in Accessibility in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-11157 local exposure check for Google Chrome
# Checks installed Chrome version against fixed version 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version():
    candidates = [
        [r'reg', 'query', r'HKLM\Software\Google\Chrome\BLBeacon', '/v', 'version'],
        [r'reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, out

    exe_paths = [
        r'C:\Program Files\Google\Chrome\Application\chrome.exe',
        r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
        os.path.expandvars(r'%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in exe_paths:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, out
    return None, ''


def get_macos_version():
    path = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(path):
        out = run_cmd([path, '--version'])
        ver = parse_version(out)
        if ver:
            return ver, out
    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        out = run_cmd(['/usr/bin/defaults', 'read', plist, 'KSVersion'])
        ver = parse_version(out)
        if ver:
            return ver, out
    return None, ''


def get_linux_version():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, out
    return None, ''


def compare_versions(a, b):
    return (a > b) - (a < b)


def main():
    system = platform.system().lower()
    if 'windows' in system:
        ver, raw = get_windows_version()
    elif 'darwin' in system:
        ver, raw = get_macos_version()
    elif 'linux' in system:
        ver, raw = get_linux_version()
    else:
        print('UNKNOWN - Unsupported OS: {}'.format(platform.system()))
        sys.exit(2)

    if not ver:
        print('UNKNOWN - Google Chrome version not found')
        sys.exit(2)

    ver_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if compare_versions(ver, FIXED) < 0:
        print('VULNERABLE - Installed Chrome version {} is older than fixed version {}'.format(ver_str, fixed_str))
        sys.exit(1)
    else:
        print('PATCHED - Installed Chrome version {} is at or above fixed version {}'.format(ver_str, fixed_str))
        sys.exit(0)


if __name__ == '__main__':
    main()