Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 149

#!/usr/bin/env python3\n# check_chrome_ios_cve_2026_11205.py\n#\n# Purpose:\n#   Check an MDM/exported inventory CSV for vulnerable Chrome for iOS versions\n#   related to CVE-2026-11205.\n#\n# Expected CSV columns (case-insensitive, best effort):\n#   device_id, app_name, version\n#\n# Exit codes:\n#   0 = all matching Chrome for iOS entries are PATCHED\n#   1 = one or more matching entries are VULNERABLE\n#   2 = UNKNOWN (missing/invalid data or no matching rows found)\n\nimport csv\nimport re\nimport sys\nfrom typing import List, Optional, Tuple\n\nFIXED_VERSION = (149, 0, 7827, 53)\n\ndef norm(s: str) -> str:\n    return (s or "").strip().lower()\n\ndef parse_version(v: str) -> Optional[Tuple[int, ...]]:\n    if not v:\n        return None\n    parts = re.findall(r"\d+", v)\n    if len(parts) < 4:\n        return None\n    try:\n        return tuple(int(x) for x in parts[:4])\n    except ValueError:\n        return None\n\ndef cmp_version(a: Tuple[int, ...], b: Tuple[int, ...]) -> int:\n    max_len = max(len(a), len(b))\n    aa = a + (0,) * (max_len - len(a))\n    bb = b + (0,) * (max_len - len(b))\n    return (aa > bb) - (aa < bb)\n\ndef looks_like_chrome_ios(app_name: str) -> bool:\n    name = norm(app_name)\n    # Best-effort matching for common inventory labels\n    needles = [\n        "chrome",\n        "google chrome",\n        "chrome for ios",\n        "com.google.chrome.ios",\n        "google llc chrome"\n    ]\n    return any(n in name for n in needles)\n\ndef main() -> int:\n    if len(sys.argv) != 2:\n        print("UNKNOWN - usage: python3 check_chrome_ios_cve_2026_11205.py <inventory.csv>")\n        return 2\n\n    path = sys.argv[1]\n    try:\n        with open(path, newline="", encoding="utf-8-sig") as f:\n            reader = csv.DictReader(f)\n            if not reader.fieldnames:\n                print("UNKNOWN - CSV has no header row")\n                return 2\n\n            fieldmap = {norm(h): h for h in reader.fieldnames}\n\n            app_field = None\n            version_field = None\n            device_field = None\n\n            for candidate in ["app_name", "app", "application", "name", "product"]:\n                if candidate in fieldmap:\n                    app_field = fieldmap[candidate]\n                    break\n\n            for candidate in ["version", "app_version", "application_version"]:\n                if candidate in fieldmap:\n                    version_field = fieldmap[candidate]\n                    break\n\n            for candidate in ["device_id", "device", "hostname", "serial", "udid"]:\n                if candidate in fieldmap:\n                    device_field = fieldmap[candidate]\n                    break\n\n            if not app_field or not version_field:\n                print("UNKNOWN - required columns not found; need app_name/app and version")\n                return 2\n\n            rows_seen = 0\n            matched = 0\n            vulnerable = []\n            unknown = []\n            patched = []\n\n            for row in reader:\n                rows_seen += 1\n                app_name = row.get(app_field, "")\n                version_raw = row.get(version_field, "")\n                device_id = row.get(device_field, "") if device_field else f"row-{rows_seen}"\n\n                if not looks_like_chrome_ios(app_name):\n                    continue\n\n                matched += 1\n                ver = parse_version(version_raw)\n                if ver is None:\n                    unknown.append((device_id, app_name, version_raw))\n                    continue\n\n                if cmp_version(ver, FIXED_VERSION) < 0:\n                    vulnerable.append((device_id, app_name, version_raw))\n                else:\n                    patched.append((device_id, app_name, version_raw))\n\n    except FileNotFoundError:\n        print(f"UNKNOWN - file not found: {path}")\n        return 2\n    except Exception as e:\n        print(f"UNKNOWN - failed to read CSV: {e}")\n        return 2\n\n    if matched == 0:\n        print("UNKNOWN - no Chrome for iOS rows matched in the provided inventory")\n        return 2\n\n    for device_id, app_name, version_raw in vulnerable:\n        print(f"VULNERABLE - device={device_id} app={app_name} version={version_raw}")\n\n    for device_id, app_name, version_raw in patched:\n        print(f"PATCHED - device={device_id} app={app_name} version={version_raw}")\n\n    for device_id, app_name, version_raw in unknown:\n        print(f"UNKNOWN - device={device_id} app={app_name} version={version_raw}")\n\n    if vulnerable:\n        return 1\n    if unknown:\n        return 2\n    return 0\n\nif __name__ == "__main__":\n    sys.exit(main())\n