Google Chrome Workers insufficient policy enforcement same-origin policy bypass after renderer compromise

#!/usr/bin/env python3
# check_chrome_cve_2026_11197.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

PATCHED_FLOOR = (149, 0, 7827, 53)
VERSION_RE = re.compile(r"(\d+)\.(\d+)\.(\d+)\.(\d+)")


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return ".".join(str(x) for x in v)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or "") + "\n" + (p.stderr or "")
        return out.strip()
    except Exception:
        return ""


def get_version_windows():
    try:
        import winreg
    except Exception:
        winreg = None

    reg_paths = [
        ("HKEY_CURRENT_USER", r"Software\Google\Chrome\BLBeacon", "version"),
        ("HKEY_LOCAL_MACHINE", r"Software\Google\Chrome\BLBeacon", "version"),
        ("HKEY_LOCAL_MACHINE", r"Software\WOW6432Node\Google\Chrome\BLBeacon", "version"),
    ]

    if winreg:
        roots = {
            "HKEY_CURRENT_USER": winreg.HKEY_CURRENT_USER,
            "HKEY_LOCAL_MACHINE": winreg.HKEY_LOCAL_MACHINE,
        }
        for root_name, subkey, value_name in reg_paths:
            try:
                with winreg.OpenKey(roots[root_name], subkey) as key:
                    value, _ = winreg.QueryValueEx(key, value_name)
                    v = parse_version(str(value))
                    if v:
                        return v, f"registry:{root_name}\\{subkey}"
            except Exception:
                pass

    paths = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in paths:
        if path and os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_version(out)
            if v:
                return v, path
    return None, ""


def get_version_macos():
    paths = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for path in paths:
        if os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_version(out)
            if v:
                return v, path
    return None, ""


def get_version_linux():
    cmds = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["/usr/bin/google-chrome", "--version"],
        ["/usr/bin/google-chrome-stable", "--version"],
        ["chromium-browser", "--version"],
        ["chromium", "--version"],
    ]
    for cmd in cmds:
        exe = cmd[0]
        if os.path.isabs(exe) and not os.path.exists(exe):
            continue
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, " ".join(cmd)
    return None, ""


def main():
    system = platform.system().lower()
    if system == "windows":
        version, source = get_version_windows()
    elif system == "darwin":
        version, source = get_version_macos()
    else:
        version, source = get_version_linux()

    if not version:
        print("UNKNOWN - Google Chrome version not found")
        sys.exit(2)

    installed = version_to_str(version)
    fixed = version_to_str(PATCHED_FLOOR)

    if version < PATCHED_FLOOR:
        print(f"VULNERABLE - Installed Chrome {installed} from {source}; fixed floor is {fixed}")
        sys.exit(1)
    else:
        print(f"PATCHED - Installed Chrome {installed} from {source}; meets/exceeds fixed floor {fixed}")
        sys.exit(0)


if __name__ == "__main__":
    main()