Use after free in Codecs in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11208.py
# Determine whether Google Chrome is below the fixed version for CVE-2026-11208.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import subprocess
import sys

DEFAULT_MIN = '149.0.7827.53'


def parse_version(v):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', v or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_versions(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        return p.returncode, (p.stdout or '').strip(), (p.stderr or '').strip()
    except Exception:
        return 1, '', ''


def get_windows_version():
    candidates = [
        [r'reg', 'query', r'HKLM\Software\Google\Chrome\BLBeacon', '/v', 'version'],
        [r'reg', 'query', r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon', '/v', 'version'],
        [r'reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'],
    ]
    for cmd in candidates:
        rc, out, _ = run_cmd(cmd)
        if rc == 0:
            m = re.search(r'version\s+REG_\w+\s+([^\s]+)', out, re.IGNORECASE)
            if m:
                return m.group(1)
    exe_paths = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LOCALAPPDATA', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for exe in exe_paths:
        if exe and os.path.exists(exe):
            rc, out, _ = run_cmd([exe, '--version'])
            if rc == 0 and out:
                return out
    return None


def get_macos_version():
    exe = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(exe):
        rc, out, _ = run_cmd([exe, '--version'])
        if rc == 0 and out:
            return out
    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        rc, out, _ = run_cmd(['/usr/bin/defaults', 'read', plist, 'KSVersion'])
        if rc == 0 and out:
            return out
        rc, out, _ = run_cmd(['/usr/bin/defaults', 'read', plist, 'CFBundleShortVersionString'])
        if rc == 0 and out:
            return out
    return None


def get_linux_version():
    commands = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in commands:
        rc, out, _ = run_cmd(cmd)
        if rc == 0 and out:
            return out
    known_paths = [
        '/opt/google/chrome/google-chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
        '/usr/bin/chromium-browser',
        '/usr/bin/chromium',
    ]
    for path in known_paths:
        if os.path.exists(path):
            rc, out, _ = run_cmd([path, '--version'])
            if rc == 0 and out:
                return out
    return None


def main():
    ap = argparse.ArgumentParser(description='Check Google Chrome version against CVE-2026-11208 fixed version')
    ap.add_argument('--min-version', default=DEFAULT_MIN, help='Fixed minimum version (default: %(default)s)')
    args = ap.parse_args()

    min_v = parse_version(args.min_version)
    if not min_v:
        print('UNKNOWN - invalid --min-version')
        sys.exit(2)

    system = platform.system().lower()
    raw_version = None

    if 'windows' in system:
        raw_version = get_windows_version()
    elif 'darwin' in system:
        raw_version = get_macos_version()
    elif 'linux' in system:
        raw_version = get_linux_version()
    else:
        print(f'UNKNOWN - unsupported platform: {platform.system()}')
        sys.exit(2)

    if not raw_version:
        print('UNKNOWN - Chrome not found or version unreadable')
        sys.exit(2)

    found_v = parse_version(raw_version)
    if not found_v:
        print(f'UNKNOWN - could not parse version from: {raw_version}')
        sys.exit(2)

    if cmp_versions(found_v, min_v) < 0:
        print(f'VULNERABLE - found {raw_version}, requires >= {args.min_version}')
        sys.exit(1)
    else:
        print(f'PATCHED - found {raw_version}, meets >= {args.min_version}')
        sys.exit(0)


if __name__ == '__main__':
    main()