Inappropriate implementation in Passwords in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11209.py
# Determine whether locally installed Chrome/Chromium appears vulnerable to CVE-2026-11209.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

TARGET = (149, 0, 7827, 53)  # Minimum patched baseline for Linux; Windows/Mac stable post also lists 53/54.
BROWSER_NAMES = [
    "Google Chrome",
    "Google Chrome.app",
    "Chromium",
    "Chromium.app",
    "chrome",
    "google-chrome",
    "chromium-browser",
    "chromium",
]


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_versions(a: Tuple[int, int, int, int], b: Tuple[int, int, int, int]) -> int:
    return (a > b) - (a < b)


def run_cmd(cmd: List[str]) -> Optional[str]:
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
        return out.strip()
    except Exception:
        return None


def candidate_commands() -> List[List[str]]:
    cmds = []
    for name in ["google-chrome", "google-chrome-stable", "chromium-browser", "chromium", "chrome"]:
        path = shutil.which(name)
        if path:
            cmds.append([path, "--version"])
    return cmds


def candidate_paths() -> List[str]:
    system = platform.system()
    paths = []

    if system == "Windows":
        env_paths = [
            os.environ.get("ProgramFiles"),
            os.environ.get("ProgramFiles(x86)"),
            os.environ.get("LocalAppData"),
        ]
        suffixes = [
            r"Google\Chrome\Application\chrome.exe",
            r"Chromium\Application\chrome.exe",
        ]
        for base in env_paths:
            if not base:
                continue
            for suf in suffixes:
                paths.append(os.path.join(base, suf))
    elif system == "Darwin":
        paths.extend([
            "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
            "/Applications/Chromium.app/Contents/MacOS/Chromium",
            os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
            os.path.expanduser("~/Applications/Chromium.app/Contents/MacOS/Chromium"),
        ])
    else:
        paths.extend([
            "/usr/bin/google-chrome",
            "/usr/bin/google-chrome-stable",
            "/usr/bin/chromium-browser",
            "/usr/bin/chromium",
            "/snap/bin/chromium",
            "/opt/google/chrome/chrome",
        ])

    return paths


def windows_file_version(path: str) -> Optional[str]:
    ps = [
        "powershell",
        "-NoProfile",
        "-Command",
        f"(Get-Item '{path}').VersionInfo.ProductVersion"
    ]
    return run_cmd(ps)


def get_versions() -> List[Tuple[str, Tuple[int, int, int, int]]]:
    found = []
    seen = set()

    for cmd in candidate_commands():
        key = tuple(cmd)
        if key in seen:
            continue
        seen.add(key)
        out = run_cmd(cmd)
        if out:
            ver = parse_version(out)
            if ver:
                found.append((cmd[0], ver))

    for path in candidate_paths():
        if not os.path.exists(path):
            continue
        if any(item[0] == path for item in found):
            continue
        if platform.system() == "Windows":
            out = windows_file_version(path)
        else:
            out = run_cmd([path, "--version"])
        if out:
            ver = parse_version(out)
            if ver:
                found.append((path, ver))

    return found


def main() -> int:
    versions = get_versions()
    if not versions:
        print("UNKNOWN - Chrome/Chromium not found or version unreadable")
        return 2

    vulnerable = []
    patched = []
    for path, ver in versions:
        if compare_versions(ver, TARGET) < 0:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    def fmt(items):
        return "; ".join([f"{p}={'.'.join(map(str, v))}" for p, v in items])

    if vulnerable and not patched:
        print(f"VULNERABLE - {fmt(vulnerable)}")
        return 1
    if patched and not vulnerable:
        print(f"PATCHED - {fmt(patched)}")
        return 0

    # Mixed state can happen on multi-user systems or where Chromium and Chrome coexist.
    print(f"UNKNOWN - mixed results; vulnerable: [{fmt(vulnerable)}] patched: [{fmt(patched)}]")
    return 2


if __name__ == "__main__":
    sys.exit(main())