Google Chrome ServiceWorker policy bypass allowing cross-origin data leakage

#!/usr/bin/env python3
# CVE-2026-11206 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

THRESHOLD = "149.0.7827.53"


def parse_version(v):
    parts = re.findall(r"\d+", v or "")
    return tuple(int(x) for x in parts)


def cmp_version(a, b):
    aa = list(parse_version(a))
    bb = list(parse_version(b))
    m = max(len(aa), len(bb))
    aa += [0] * (m - len(aa))
    bb += [0] * (m - len(bb))
    if aa < bb:
        return -1
    if aa > bb:
        return 1
    return 0


def add_result(results, path, version):
    if version:
        results.append((path, version.strip()))


def get_windows_versions():
    results = []
    try:
        import winreg
    except Exception:
        winreg = None

    reg_paths = [
        r"SOFTWARE\Google\Chrome\BLBeacon",
        r"SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon",
    ]
    if winreg:
        for hive in (winreg.HKEY_CURRENT_USER, winreg.HKEY_LOCAL_MACHINE):
            for reg_path in reg_paths:
                try:
                    with winreg.OpenKey(hive, reg_path) as key:
                        version, _ = winreg.QueryValueEx(key, "version")
                        add_result(results, f"registry:{reg_path}", version)
                except OSError:
                    pass

    exe_paths = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for exe in exe_paths:
        if exe and os.path.exists(exe):
            try:
                out = subprocess.check_output([
                    "powershell",
                    "-NoProfile",
                    "-Command",
                    f"(Get-Item '{exe}').VersionInfo.ProductVersion"
                ], stderr=subprocess.DEVNULL, text=True, timeout=10)
                add_result(results, exe, out)
            except Exception:
                pass
    return results


def get_macos_versions():
    results = []
    apps = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for app in apps:
        if os.path.exists(app):
            try:
                out = subprocess.check_output([app, "--version"], stderr=subprocess.DEVNULL, text=True, timeout=10)
                m = re.search(r"(\d+\.\d+\.\d+\.\d+)", out)
                if m:
                    add_result(results, app, m.group(1))
            except Exception:
                pass
    return results


def get_linux_versions():
    results = []
    candidates = [
        "google-chrome",
        "google-chrome-stable",
        "chromium",
        "chromium-browser",
    ]
    for cmd in candidates:
        path = shutil.which(cmd)
        if path:
            try:
                out = subprocess.check_output([path, "--version"], stderr=subprocess.DEVNULL, text=True, timeout=10)
                m = re.search(r"(\d+\.\d+\.\d+\.\d+)", out)
                if m:
                    add_result(results, path, m.group(1))
            except Exception:
                pass
    return results


def main():
    system = platform.system().lower()
    results = []

    if "windows" in system:
        results = get_windows_versions()
    elif "darwin" in system:
        results = get_macos_versions()
    elif "linux" in system:
        results = get_linux_versions()
    else:
        print("UNKNOWN - unsupported platform")
        sys.exit(2)

    # de-duplicate by version/path pairs
    uniq = []
    seen = set()
    for item in results:
        if item not in seen:
            uniq.append(item)
            seen.add(item)
    results = uniq

    if not results:
        print("UNKNOWN - Chrome not found")
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []

    for path, version in results:
        if not parse_version(version):
            unknown.append((path, version))
        elif cmp_version(version, THRESHOLD) < 0:
            vulnerable.append((path, version))
        else:
            patched.append((path, version))

    if vulnerable:
        detail = "; ".join([f"{p}={v}" for p, v in vulnerable])
        print(f"VULNERABLE - found Chrome below {THRESHOLD}: {detail}")
        sys.exit(1)

    if patched and not vulnerable:
        detail = "; ".join([f"{p}={v}" for p, v in patched])
        print(f"PATCHED - found Chrome at or above {THRESHOLD}: {detail}")
        sys.exit(0)

    detail = "; ".join([f"{p}={v}" for p, v in unknown]) if unknown else "version parse failed"
    print(f"UNKNOWN - {detail}")
    sys.exit(2)


if __name__ == "__main__":
    main()