Use after free in V8 in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_11185.py
# Detects whether locally installed Google Chrome is vulnerable to CVE-2026-11185
# Affected: Google Chrome versions prior to 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def check_binary(path):
    if not path or not os.path.exists(path):
        return None
    out = run_cmd([path, '--version'])
    v = parse_version(out)
    if v:
        return {'path': path, 'version': v, 'source': 'binary'}
    return None


def windows_checks():
    results = []
    candidates = [
        r'C:\Program Files\Google\Chrome\Application\chrome.exe',
        r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
        os.path.expandvars(r'%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe'),
    ]
    for c in candidates:
        item = check_binary(c)
        if item:
            results.append(item)

    try:
        import winreg  # type: ignore
        reg_paths = [
            (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'Software\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'Software\WOW6432Node\Google\Chrome\BLBeacon'),
        ]
        for hive, subkey in reg_paths:
            try:
                k = winreg.OpenKey(hive, subkey)
                val, _ = winreg.QueryValueEx(k, 'version')
                v = parse_version(val)
                if v:
                    results.append({'path': subkey, 'version': v, 'source': 'registry'})
            except OSError:
                pass
    except Exception:
        pass

    return results


def mac_checks():
    results = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for c in candidates:
        item = check_binary(c)
        if item:
            results.append(item)
    return results


def linux_checks():
    results = []
    commands = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'
    ]
    for cmd in commands:
        full = shutil.which(cmd)
        if full:
            item = check_binary(full)
            if item:
                results.append(item)

    candidates = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
    ]
    for c in candidates:
        item = check_binary(c)
        if item:
            results.append(item)
    return results


def dedupe(results):
    seen = set()
    out = []
    for r in results:
        key = (r['path'], r['version'], r['source'])
        if key not in seen:
            seen.add(key)
            out.append(r)
    return out


def main():
    system = platform.system().lower()
    results = []

    if 'windows' in system:
        results = windows_checks()
    elif 'darwin' in system or 'mac' in system:
        results = mac_checks()
    else:
        results = linux_checks()

    results = dedupe(results)

    if not results:
        print('UNKNOWN: Google Chrome not found or version could not be determined')
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []

    for r in results:
        v = r.get('version')
        if not v:
            unknown.append(r)
        elif v < THRESHOLD:
            vulnerable.append(r)
        else:
            patched.append(r)

    if vulnerable:
        details = '; '.join([f"{x['path']}={version_str(x['version'])}" for x in vulnerable])
        print(f'VULNERABLE: installed Google Chrome version(s) below {version_str(THRESHOLD)} detected: {details}')
        sys.exit(1)

    if patched:
        details = '; '.join([f"{x['path']}={version_str(x['version'])}" for x in patched])
        print(f'PATCHED: detected installed Google Chrome version(s) at or above {version_str(THRESHOLD)}: {details}')
        sys.exit(0)

    print('UNKNOWN: Chrome found, but version state could not be classified')
    sys.exit(2)


if __name__ == '__main__':
    main()