Google Chrome Web Bluetooth insufficient policy enforcement sandbox-escape helper

#!/usr/bin/env python3
# Check for CVE-2026-11236 exposure by local Google Chrome version
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_version(cmd):
    try:
        p = subprocess.run([cmd, '--version'], capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def run_file_version(path):
    try:
        p = subprocess.run([str(path), '--version'], capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def candidate_paths():
    system = platform.system().lower()
    cands = []

    if system == 'windows':
        envs = [
            os.environ.get('ProgramFiles'),
            os.environ.get('ProgramFiles(x86)'),
            os.environ.get('LocalAppData'),
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
        ]
        for base in envs:
            if not base:
                continue
            for suf in suffixes:
                cands.append(Path(base) / suf)
    elif system == 'darwin':
        cands.extend([
            Path('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        ])
    else:
        for bin_name in ['google-chrome', 'google-chrome-stable', 'chrome']:
            resolved = shutil.which(bin_name)
            if resolved:
                cands.append(Path(resolved))
        cands.extend([
            Path('/opt/google/chrome/google-chrome'),
            Path('/usr/bin/google-chrome'),
            Path('/usr/bin/google-chrome-stable'),
        ])

    # preserve order, remove duplicates
    seen = set()
    uniq = []
    for p in cands:
        s = str(p)
        if s not in seen:
            seen.add(s)
            uniq.append(p)
    return uniq


def main():
    found = []

    # PATH-based check first for Unix-like systems
    for bin_name in ['google-chrome', 'google-chrome-stable', 'chrome']:
        resolved = shutil.which(bin_name)
        if resolved:
            ver = run_version(resolved)
            if ver:
                found.append((resolved, ver))

    # Common install paths
    for path in candidate_paths():
        if path.exists() and os.access(path, os.X_OK):
            ver = run_file_version(path)
            if ver:
                found.append((str(path), ver))

    # De-duplicate by path/version
    dedup = []
    seen = set()
    for item in found:
        if item not in seen:
            seen.add(item)
            dedup.append(item)
    found = dedup

    if not found:
        print('UNKNOWN - Google Chrome not found or version unreadable')
        sys.exit(2)

    # If any installed Chrome is below fixed version, flag vulnerable.
    vulnerable = []
    patched = []
    for path, ver in found:
        if cmp_ver(ver, FIXED) < 0:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    if vulnerable:
        details = ', '.join([f'{p}={".".join(map(str, v))}' for p, v in vulnerable])
        print(f'VULNERABLE - Chrome build below 149.0.7827.53 detected: {details}')
        sys.exit(1)

    details = ', '.join([f'{p}={".".join(map(str, v))}' for p, v in patched])
    print(f'PATCHED - Chrome build is at or above 149.0.7827.53: {details}')
    sys.exit(0)


if __name__ == '__main__':
    main()