Inappropriate implementation in WebUI in Google Chrome prior to 149

#!/usr/bin/env python3
# Check exposure to CVE-2026-11225 (Google Chrome WebUI domain spoofing)
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import subprocess
import sys
from pathlib import Path

THRESHOLD = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return None, ''


def get_version_from_binary(path):
    rc, out = run_cmd([path, '--version'])
    if rc is None:
        return None
    return parse_version(out)


def get_windows_version_from_reg():
    try:
        import winreg
    except Exception:
        return None

    keys = [
        (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon', 'version'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon', 'version'),
        (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon', 'version'),
    ]

    for hive, subkey, value_name in keys:
        try:
            with winreg.OpenKey(hive, subkey) as k:
                value, _ = winreg.QueryValueEx(k, value_name)
                ver = parse_version(str(value))
                if ver:
                    return ver
        except OSError:
            continue
    return None


def find_windows_binary():
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for c in candidates:
        if c and os.path.exists(c):
            return c
    return None


def find_macos_binary():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for c in candidates:
        if os.path.exists(c):
            return c
    return None


def find_linux_binary():
    candidates = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    for c in candidates:
        rc, out = run_cmd([c, '--version'])
        if rc is not None and parse_version(out):
            return c
    paths = [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
    ]
    for p in paths:
        if os.path.exists(p):
            return p
    return None


def determine_version(explicit_path=None):
    if explicit_path:
        return get_version_from_binary(explicit_path), explicit_path

    system = platform.system().lower()

    if system == 'windows':
        ver = get_windows_version_from_reg()
        if ver:
            return ver, 'registry'
        binary = find_windows_binary()
        if binary:
            return get_version_from_binary(binary), binary
        return None, 'not found'

    if system == 'darwin':
        binary = find_macos_binary()
        if binary:
            return get_version_from_binary(binary), binary
        return None, 'not found'

    binary = find_linux_binary()
    if binary:
        return get_version_from_binary(binary), binary
    return None, 'not found'


def main():
    parser = argparse.ArgumentParser(description='Check if local Chrome is vulnerable to CVE-2026-11225')
    parser.add_argument('--path', help='Path to Chrome binary')
    args = parser.parse_args()

    ver, source = determine_version(args.path)
    if not ver:
        print(f'UNKNOWN - Could not determine Chrome version (source: {source})')
        sys.exit(2)

    ver_str = '.'.join(map(str, ver))
    threshold_str = '.'.join(map(str, THRESHOLD))

    if cmp_version(ver, THRESHOLD) < 0:
        print(f'VULNERABLE - Chrome version {ver_str} is older than fixed version {threshold_str} (source: {source})')
        sys.exit(1)
    else:
        print(f'PATCHED - Chrome version {ver_str} is at or newer than fixed version {threshold_str} (source: {source})')
        sys.exit(0)


if __name__ == '__main__':
    main()