Out of bounds read in GWP-ASan in Google Chrome prior to 149

#!/usr/bin/env python3
# Check Google Chrome version for CVE-2026-11183
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def check_explicit_path(pth):
    p = Path(pth)
    if not p.exists():
        return None, f'Path not found: {pth}'
    return get_version_from_path(str(p))


def get_version_from_path(pth):
    system = platform.system()
    if system == 'Windows':
        # Use PowerShell to read file version without needing pywin32
        cmd = [
            'powershell', '-NoProfile', '-Command',
            f"(Get-Item '{pth}').VersionInfo.ProductVersion"
        ]
        out = run_cmd(cmd)
        v = parse_version(out)
        return v, pth
    else:
        out = run_cmd([pth, '--version'])
        v = parse_version(out)
        return v, pth


def find_linux():
    candidates = [
        'google-chrome',
        'google-chrome-stable',
        '/opt/google/chrome/google-chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for c in candidates:
        out = run_cmd([c, '--version']) if not c.startswith('/') else run_cmd([c, '--version'])
        v = parse_version(out)
        if v:
            return v, c
    return None, None


def find_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for c in candidates:
        if os.path.exists(c):
            out = run_cmd([c, '--version'])
            v = parse_version(out)
            if v:
                return v, c
    return None, None


def find_windows():
    local = os.environ.get('LOCALAPPDATA', '')
    program_files = os.environ.get('ProgramFiles', '')
    program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
    candidates = [
        os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(program_files, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(program_files_x86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for c in candidates:
        if c and os.path.exists(c):
            v, src = get_version_from_path(c)
            if v:
                return v, src
    return None, None


def main():
    if len(sys.argv) > 1:
        v, src = check_explicit_path(sys.argv[1])
    else:
        system = platform.system()
        if system == 'Linux':
            v, src = find_linux()
        elif system == 'Darwin':
            v, src = find_macos()
        elif system == 'Windows':
            v, src = find_windows()
        else:
            print(f'UNKNOWN - Unsupported platform: {system}')
            sys.exit(2)

    if not v:
        print('UNKNOWN - Google Chrome not found or version could not be determined')
        sys.exit(2)

    if cmp_ver(v, FIXED) < 0:
        print(f'VULNERABLE - Found Chrome {version_to_str(v)} at {src}; fixed version is {version_to_str(FIXED)} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - Found Chrome {version_to_str(v)} at {src}; fixed version is {version_to_str(FIXED)}')
        sys.exit(0)


if __name__ == '__main__':
    main()