Inappropriate implementation in Media Session in Google Chrome prior to 149

#!/usr/bin/env python3
# Check Google Chrome version against CVE-2026-11181 fixed version
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import plistlib
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(s):
    if not s:
        return None
    m = VERSION_RE.search(str(s))
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_windows():
    try:
        import winreg  # type: ignore
    except Exception:
        return None

    paths = [
        (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon', 'version'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon', 'version'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon', 'version'),
    ]

    for hive, path, name in paths:
        try:
            with winreg.OpenKey(hive, path) as key:
                value, _ = winreg.QueryValueEx(key, name)
                v = parse_version(value)
                if v:
                    return v
        except Exception:
            pass

    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for exe in candidates:
        if os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            v = parse_version(out)
            if v:
                return v
    return None


def detect_macos():
    plist_paths = [
        '/Applications/Google Chrome.app/Contents/Info.plist',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/Info.plist'),
    ]
    for path in plist_paths:
        try:
            with open(path, 'rb') as f:
                data = plistlib.load(f)
            v = parse_version(data.get('CFBundleShortVersionString'))
            if v:
                return v
        except Exception:
            pass

    out = run_cmd(['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '--version'])
    v = parse_version(out)
    if v:
        return v
    return None


def detect_linux():
    for cmd in (['google-chrome', '--version'], ['google-chrome-stable', '--version']):
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v
    return None


def main():
    parser = argparse.ArgumentParser(description='Check Chrome version for CVE-2026-11181 exposure')
    parser.add_argument('--version', help='Installed Chrome version to evaluate, e.g. 149.0.7827.22')
    args = parser.parse_args()

    if args.version:
        detected = parse_version(args.version)
        if not detected:
            print('UNKNOWN - could not parse supplied version')
            sys.exit(2)
    else:
        system = platform.system().lower()
        if 'windows' in system:
            detected = detect_windows()
        elif 'darwin' in system or 'mac' in system:
            detected = detect_macos()
        elif 'linux' in system:
            detected = detect_linux()
        else:
            detected = None

        if not detected:
            print('UNKNOWN - could not detect installed Google Chrome version')
            sys.exit(2)

    detected_str = '.'.join(str(x) for x in detected)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if cmp_version(detected, FIXED) < 0:
        print(f'VULNERABLE - detected Chrome {detected_str}, fixed version is {fixed_str}')
        sys.exit(1)
    else:
        print(f'PATCHED - detected Chrome {detected_str}, fixed version is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()