Google Chrome Extensions policy enforcement bypass via malicious extension

#!/usr/bin/env python3
# check_chrome_cve_2026_11190.py
# Detects whether the local Chrome/Chromium installation is vulnerable to CVE-2026-11190.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

PATCHED_MIN = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(v):
    return '.'.join(str(x) for x in v)


def compare(v1, v2):
    return (v1 > v2) - (v1 < v2)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=5)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_versions():
    findings = []
    try:
        import winreg
    except Exception:
        return findings

    reg_paths = [
        (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon', 'version', 'Chrome HKCU'),
        (winreg.HKEY_LOCAL_MACHINE, r'Software\Google\Chrome\BLBeacon', 'version', 'Chrome HKLM'),
        (winreg.HKEY_CURRENT_USER, r'Software\Chromium\BLBeacon', 'version', 'Chromium HKCU'),
        (winreg.HKEY_LOCAL_MACHINE, r'Software\Chromium\BLBeacon', 'version', 'Chromium HKLM'),
        (winreg.HKEY_LOCAL_MACHINE, r'Software\WOW6432Node\Google\Chrome\BLBeacon', 'version', 'Chrome WOW6432Node'),
        (winreg.HKEY_LOCAL_MACHINE, r'Software\WOW6432Node\Chromium\BLBeacon', 'version', 'Chromium WOW6432Node'),
    ]

    for hive, path, value_name, label in reg_paths:
        try:
            key = winreg.OpenKey(hive, path)
            value, _ = winreg.QueryValueEx(key, value_name)
            v = parse_version(str(value))
            if v:
                findings.append((label, v))
        except Exception:
            pass
    return findings


def get_macos_versions():
    findings = []
    apps = [
        ('Google Chrome', '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ('Chromium', '/Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]
    for label, path in apps:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                findings.append((label, v))
    return findings


def get_linux_versions():
    findings = []
    candidates = [
        ('google-chrome', ['google-chrome', '--version']),
        ('google-chrome-stable', ['google-chrome-stable', '--version']),
        ('chromium', ['chromium', '--version']),
        ('chromium-browser', ['chromium-browser', '--version']),
        ('chrome', ['chrome', '--version']),
    ]
    for label, cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            findings.append((label, v))
    return findings


def main():
    system = platform.system().lower()
    findings = []

    if 'windows' in system:
        findings = get_windows_versions()
    elif 'darwin' in system:
        findings = get_macos_versions()
    else:
        findings = get_linux_versions()

    if not findings:
        print('UNKNOWN - No Chrome/Chromium version found')
        sys.exit(2)

    vulnerable = []
    patched = []
    for label, version in findings:
        if compare(version, PATCHED_MIN) < 0:
            vulnerable.append((label, version))
        else:
            patched.append((label, version))

    for label, version in findings:
        status = 'VULNERABLE' if compare(version, PATCHED_MIN) < 0 else 'PATCHED'
        print(f'{status} - {label} {ver_to_str(version)}')

    if vulnerable:
        worst = ', '.join(f'{label} {ver_to_str(version)}' for label, version in vulnerable)
        print(f'VERDICT: VULNERABLE - Found version(s) older than {ver_to_str(PATCHED_MIN)}: {worst}')
        sys.exit(1)

    best = ', '.join(f'{label} {ver_to_str(version)}' for label, version in patched)
    print(f'VERDICT: PATCHED - All discovered version(s) are >= {ver_to_str(PATCHED_MIN)}: {best}')
    sys.exit(0)


if __name__ == '__main__':
    main()