Google Chrome Extensions use-after-free leading to sandboxed code execution

#!/usr/bin/env python3
# Check Google Chrome version for CVE-2026-11230
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v)


def get_version_from_command(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def get_windows_version():
    candidates = [
        ["reg", "query", r"HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe", "/ve"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe", "/ve"],
    ]
    exe_path = None
    for cmd in candidates:
        try:
            p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            data = (p.stdout or '') + (p.stderr or '')
            m = re.search(r'REG_SZ\s+(.*chrome\.exe)', data, re.IGNORECASE)
            if m:
                exe_path = m.group(1).strip()
                break
        except Exception:
            pass

    common_paths = [
        exe_path,
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    ]
    for path in common_paths:
        if path and os.path.exists(path):
            v = get_version_from_command([path, "--version"])
            if v:
                return v
    return None


def get_macos_version():
    path = "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
    if os.path.exists(path):
        return get_version_from_command([path, "--version"])
    return None


def get_linux_version():
    for binary in ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser"]:
        full = shutil.which(binary)
        if full:
            v = get_version_from_command([full, "--version"])
            if v:
                return v
    return None


def main():
    system = platform.system().lower()
    version = None

    if 'windows' in system:
        version = get_windows_version()
    elif 'darwin' in system:
        version = get_macos_version()
    elif 'linux' in system:
        version = get_linux_version()

    if version is None:
        print("UNKNOWN: Could not determine Chrome version on this host")
        sys.exit(2)

    if version < FIXED:
        print(f"VULNERABLE: Detected Chrome {version_str(version)} < {version_str(FIXED)}")
        sys.exit(1)
    else:
        print(f"PATCHED: Detected Chrome {version_str(version)} >= {version_str(FIXED)}")
        sys.exit(0)


if __name__ == '__main__':
    main()