Google Chrome Safe Browsing discretionary access-control bypass via crafted RAR file

#!/usr/bin/env python3
# Check Google Chrome version for CVE-2026-11210
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version():
    try:
        import winreg
    except Exception:
        return None, None

    reg_paths = [
        (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon'),
    ]

    for hive, path in reg_paths:
        try:
            with winreg.OpenKey(hive, path) as key:
                version, _ = winreg.QueryValueEx(key, 'version')
                pv = parse_version(version)
                if pv:
                    return version, 'registry:' + path
        except Exception:
            pass

    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for exe in candidates:
        if exe and os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            pv = parse_version(out)
            if pv:
                return '.'.join(str(x) for x in pv), exe
    return None, None


def get_macos_version():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(app):
        out = run_cmd([app, '--version'])
        pv = parse_version(out)
        if pv:
            return '.'.join(str(x) for x in pv), app
    return None, None


def get_linux_version():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        pv = parse_version(out)
        if pv:
            return '.'.join(str(x) for x in pv), cmd[0]
    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'windows' in system:
        version, source = get_windows_version()
    elif 'darwin' in system:
        version, source = get_macos_version()
    elif 'linux' in system:
        version, source = get_linux_version()

    if not version:
        print('UNKNOWN - Google Chrome version not found on this host')
        sys.exit(2)

    pv = parse_version(version)
    if not pv:
        print(f'UNKNOWN - Unable to parse version: {version}')
        sys.exit(2)

    if cmp_ver(pv, FIXED) < 0:
        print(f'VULNERABLE - Detected Chrome {version} via {source}; fixed version is 149.0.7827.53 or later')
        sys.exit(1)
    else:
        print(f'PATCHED - Detected Chrome {version} via {source}; fixed version is 149.0.7827.53 or later')
        sys.exit(0)


if __name__ == '__main__':
    main()