Inappropriate implementation in DevTools in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-11238 Chrome version check
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)

def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return 1, ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        pf = os.environ.get('PROGRAMFILES', '')
        pf86 = os.environ.get('PROGRAMFILES(X86)', '')
        paths = [
            Path(local) / 'Google/Chrome/Application/chrome.exe',
            Path(pf) / 'Google/Chrome/Application/chrome.exe',
            Path(pf86) / 'Google/Chrome/Application/chrome.exe',
        ]
        for p in paths:
            cmds.append([str(p), '--version'])
        cmds.append(['reg', 'query', r'HKLM\Software\Google\Chrome\BLBeacon', '/v', 'version'])
        cmds.append(['reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'])

    elif system == 'darwin':
        paths = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
        ]
        for p in paths:
            cmds.append([p, '--version'])
        cmds.append(['mdfind', 'kMDItemCFBundleIdentifier == "com.google.Chrome"'])

    else:
        for name in ['google-chrome', 'google-chrome-stable', '/opt/google/chrome/chrome', '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable']:
            cmds.append([name, '--version'])

    return cmds


def extract_version_from_output(output):
    return parse_version(output)


def main():
    found_versions = []

    for cmd in candidate_commands():
        rc, out = run_cmd(cmd)
        if not out:
            continue

        # macOS mdfind fallback: if Chrome app exists, try running it
        if cmd[0] == 'mdfind':
            for line in out.splitlines():
                app = line.strip()
                if app.endswith('Google Chrome.app'):
                    binpath = app + '/Contents/MacOS/Google Chrome'
                    rc2, out2 = run_cmd([binpath, '--version'])
                    ver = extract_version_from_output(out2)
                    if ver:
                        found_versions.append((binpath, ver))
            continue

        ver = extract_version_from_output(out)
        if ver:
            found_versions.append((' '.join(cmd), ver))

    if not found_versions:
        print('UNKNOWN - Google Chrome version not found')
        sys.exit(2)

    # Prefer highest discovered version in case multiple installs exist
    best_path, best_ver = sorted(found_versions, key=lambda x: x[1], reverse=True)[0]

    if version_lt(best_ver, FIXED):
        print(f'VULNERABLE - Google Chrome {best_ver[0]}.{best_ver[1]}.{best_ver[2]}.{best_ver[3]} found via {best_path}; fixed version is 149.0.7827.53+')
        sys.exit(1)
    else:
        print(f'PATCHED - Google Chrome {best_ver[0]}.{best_ver[1]}.{best_ver[2]}.{best_ver[3]} found via {best_path}')
        sys.exit(0)

if __name__ == '__main__':
    main()