Insufficient validation of untrusted input in Plugins in Google Chrome prior to 149

#!/usr/bin/env python3
# CVE-2026-11242 Chrome version check
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def detect_linux():
    candidates = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium", "--version"],
        ["chromium-browser", "--version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, out
    paths = [
        "/opt/google/chrome/chrome",
        "/usr/bin/google-chrome",
        "/usr/bin/google-chrome-stable",
        "/usr/bin/chromium",
        "/usr/bin/chromium-browser",
    ]
    for pth in paths:
        if os.path.exists(pth):
            out = run_cmd([pth, "--version"])
            v = parse_version(out)
            if v:
                return v, out
    return None, None


def detect_macos():
    paths = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
        "/Applications/Chromium.app/Contents/MacOS/Chromium",
    ]
    for pth in paths:
        if os.path.exists(pth):
            out = run_cmd([pth, "--version"])
            v = parse_version(out)
            if v:
                return v, out
    return None, None


def detect_windows():
    try:
        import winreg
    except Exception:
        winreg = None

    reg_paths = [
        (0x80000002, r"SOFTWARE\Google\Chrome\BLBeacon", "version"),  # HKEY_LOCAL_MACHINE
        (0x80000001, r"SOFTWARE\Google\Chrome\BLBeacon", "version"),  # HKEY_CURRENT_USER
        (0x80000002, r"SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon", "version"),
    ]

    if winreg:
        hive_map = {
            0x80000002: winreg.HKEY_LOCAL_MACHINE,
            0x80000001: winreg.HKEY_CURRENT_USER,
        }
        for hive_id, subkey, value_name in reg_paths:
            try:
                with winreg.OpenKey(hive_map[hive_id], subkey) as key:
                    value, _ = winreg.QueryValueEx(key, value_name)
                    v = parse_version(str(value))
                    if v:
                        return v, str(value)
            except Exception:
                pass

    candidates = []
    for base in [os.environ.get("ProgramFiles"), os.environ.get("ProgramFiles(x86)"), os.environ.get("LocalAppData")]:
        if not base:
            continue
        candidates.append(os.path.join(base, "Google", "Chrome", "Application", "chrome.exe"))
        candidates.append(os.path.join(base, "Chromium", "Application", "chrome.exe"))

    for exe in candidates:
        if os.path.exists(exe):
            out = run_cmd([exe, "--version"])
            v = parse_version(out)
            if v:
                return v, out
    return None, None


def main():
    parser = argparse.ArgumentParser(description="Check local Chrome/Chromium version for CVE-2026-11242 exposure")
    parser.add_argument("--version", help="Version string from inventory, e.g. 149.0.7827.53")
    args = parser.parse_args()

    if args.version:
        v = parse_version(args.version)
        if not v:
            print("UNKNOWN")
            sys.exit(2)
        if cmp_version(v, FIXED) < 0:
            print("VULNERABLE")
            sys.exit(1)
        print("PATCHED")
        sys.exit(0)

    system = platform.system().lower()
    version = None
    raw = None

    if "linux" in system:
        version, raw = detect_linux()
    elif "darwin" in system:
        version, raw = detect_macos()
    elif "windows" in system:
        version, raw = detect_windows()
    else:
        print("UNKNOWN")
        sys.exit(2)

    if not version:
        print("UNKNOWN")
        sys.exit(2)

    if cmp_version(version, FIXED) < 0:
        print("VULNERABLE")
        sys.exit(1)
    else:
        print("PATCHED")
        sys.exit(0)


if __name__ == "__main__":
    main()