Google Chrome Reading Mode insufficient input validation sandbox escape

#!/usr/bin/env python3
# CVE-2026-11213 Chrome version checker
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def find_linux_version():
    candidates = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'
    ]
    for c in candidates:
        path = which(c)
        if path:
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return ('linux', path, v)
    return None


def find_macos_version():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium'
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return ('macos', path, v)
    return None


def find_windows_version():
    powershell = which('powershell') or which('pwsh')
    if not powershell:
        return None

    ps_script = r"""
$paths = @(
  "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe",
  "$Env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
  "$Env:LocalAppData\Google\Chrome\Application\chrome.exe",
  "$Env:ProgramFiles\Chromium\Application\chrome.exe",
  "$Env:ProgramFiles(x86)\Chromium\Application\chrome.exe"
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    try {
      $v = (Get-Item $p).VersionInfo.ProductVersion
      Write-Output "$p|$v"
      exit 0
    } catch {}
  }
}
exit 1
"""
    out = run_cmd([powershell, '-NoProfile', '-Command', ps_script])
    if '|' in out:
        path, ver = out.split('|', 1)
        v = parse_version(ver)
        if v:
            return ('windows', path.strip(), v)
    return None


def main():
    system = platform.system().lower()
    result = None

    if 'windows' in system:
        result = find_windows_version()
    elif 'darwin' in system:
        result = find_macos_version()
    else:
        result = find_linux_version()

    if not result:
        print('UNKNOWN - Chrome/Chromium not found or version unreadable')
        sys.exit(2)

    os_name, path, version = result

    # This check is version-based only; it does not validate whether Reading Mode is enabled/reachable.
    if version < FIXED:
        print(f'VULNERABLE - {os_name} {path} version {version_to_str(version)} is older than fixed {version_to_str(FIXED)}')
        sys.exit(1)
    else:
        print(f'PATCHED - {os_name} {path} version {version_to_str(version)} is at or above fixed {version_to_str(FIXED)}')
        sys.exit(0)


if __name__ == '__main__':
    main()