Inappropriate implementation in Signin in Google Chrome on iOS prior to 149

#!/usr/bin/env python3
# check_chrome_ios_cve_2026_11204.py
# Exit codes:
#   0 = all matching Chrome on iOS entries are PATCHED
#   1 = one or more matching Chrome on iOS entries are VULNERABLE
#   2 = UNKNOWN / bad input / no matching inventory rows

import csv
import re
import sys
from pathlib import Path

FIXED_VERSION = "149.0.7827.53"
TARGET_NAMES = {
    "google chrome",
    "chrome",
    "google chrome: fast & secure",
}


def normalize(s):
    return (s or "").strip().lower()


def parse_version(v):
    if not v:
        return None
    parts = re.findall(r"\d+", v)
    if not parts:
        return None
    return tuple(int(x) for x in parts)


def cmp_versions(a, b):
    la, lb = len(a), len(b)
    n = max(la, lb)
    a = a + (0,) * (n - la)
    b = b + (0,) * (n - lb)
    if a < b:
        return -1
    if a > b:
        return 1
    return 0


def is_ios(platform_value):
    p = normalize(platform_value)
    return p in {"ios", "iphone", "iphone os", "ipados", "ipad os"}


def is_chrome(app_name):
    return normalize(app_name) in TARGET_NAMES


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_chrome_ios_cve_2026_11204.py <mdm_export.csv>")
        sys.exit(2)

    csv_path = Path(sys.argv[1])
    if not csv_path.exists() or not csv_path.is_file():
        print(f"UNKNOWN - file not found: {csv_path}")
        sys.exit(2)

    fixed = parse_version(FIXED_VERSION)
    if fixed is None:
        print("UNKNOWN - internal fixed version parse failure")
        sys.exit(2)

    required_headers = {"device_name", "platform", "app_name", "app_version"}
    matches = []
    unknowns = []
    vulnerable = []
    patched = []

    try:
        with csv_path.open("r", encoding="utf-8-sig", newline="") as fh:
            reader = csv.DictReader(fh)
            headers = set(reader.fieldnames or [])
            if not required_headers.issubset(headers):
                print("UNKNOWN - CSV must contain headers: device_name, platform, app_name, app_version")
                sys.exit(2)

            for row in reader:
                device = (row.get("device_name") or "").strip() or "<unknown-device>"
                platform = row.get("platform") or ""
                app_name = row.get("app_name") or ""
                app_version = (row.get("app_version") or "").strip()

                if not is_ios(platform):
                    continue
                if not is_chrome(app_name):
                    continue

                matches.append(device)
                parsed = parse_version(app_version)
                if parsed is None:
                    unknowns.append((device, app_version or "<blank>"))
                    continue

                if cmp_versions(parsed, fixed) < 0:
                    vulnerable.append((device, app_version))
                else:
                    patched.append((device, app_version))
    except Exception as e:
        print(f"UNKNOWN - failed to read CSV: {e}")
        sys.exit(2)

    if not matches:
        print("UNKNOWN - no Chrome on iOS rows found in inventory")
        sys.exit(2)

    for device, version in vulnerable:
        print(f"VULNERABLE - {device} - Chrome iOS {version} < {FIXED_VERSION}")
    for device, version in patched:
        print(f"PATCHED - {device} - Chrome iOS {version} >= {FIXED_VERSION}")
    for device, version in unknowns:
        print(f"UNKNOWN - {device} - unparseable version: {version}")

    if vulnerable:
        sys.exit(1)
    if unknowns:
        sys.exit(2)
    sys.exit(0)


if __name__ == "__main__":
    main()