Google Chrome CSS inappropriate implementation leading to arbitrary script or HTML injection

#!/usr/bin/env python3
# CVE-2026-11186 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

PATCH_LINUX = (149, 0, 7827, 53)
PATCH_WIN_MAC = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_ge(a, b):
    return a >= b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_linux():
    candidates = [
        shutil.which('google-chrome'),
        shutil.which('google-chrome-stable'),
        shutil.which('chromium-browser'),
        shutil.which('chromium'),
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable'
    ]
    for c in candidates:
        if c and os.path.exists(c):
            out = run_cmd([c, '--version'])
            v = parse_version(out)
            if v:
                return ('Linux', c, v, out)
    return None


def detect_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
    ]
    for c in candidates:
        if os.path.exists(c):
            out = run_cmd([c, '--version'])
            v = parse_version(out)
            if v:
                return ('macOS', c, v, out)
    return None


def detect_windows():
    exe_names = []
    for base in filter(None, [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData')
    ]):
        exe_names.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))

    for c in exe_names:
        if os.path.exists(c):
            out = run_cmd([c, '--version'])
            if not out:
                ps = f"(Get-Item '{c}').VersionInfo.ProductVersion"
                out = run_cmd(['powershell', '-NoProfile', '-Command', ps])
            v = parse_version(out)
            if v:
                return ('Windows', c, v, out)
    return None


def main():
    system = platform.system().lower()
    info = None

    if 'linux' in system:
        info = detect_linux()
    elif 'darwin' in system:
        info = detect_macos()
    elif 'windows' in system:
        info = detect_windows()
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not info:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    os_name, path, version, raw = info
    patch = PATCH_LINUX if os_name == 'Linux' else PATCH_WIN_MAC

    print(f'Detected platform: {os_name}')
    print(f'Executable: {path}')
    print(f'Raw version output: {raw}')
    print(f'Parsed version: {".".join(map(str, version))}')
    print(f'Patched threshold: {".".join(map(str, patch))}')

    if version_ge(version, patch):
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()