Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_11244.py
# Determine whether locally installed Google Chrome is vulnerable to CVE-2026-11244.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

PATCHED_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_versions(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        pass
    return None


def candidate_paths():
    system = platform.system().lower()
    paths = []

    if 'windows' in system:
        envs = [
            os.environ.get('PROGRAMFILES'),
            os.environ.get('PROGRAMFILES(X86)'),
            os.environ.get('LOCALAPPDATA')
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Google\Chrome Beta\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for suf in suffixes:
                    paths.append(str(Path(base) / Path(suf)))

    elif 'darwin' in system:
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
        ])

    else:
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/opt/google/chrome/chrome',
            '/snap/bin/chromium',
        ])
        for bin_name in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']:
            p = shutil.which(bin_name)
            if p:
                paths.append(p)

    # de-dup while preserving order
    seen = set()
    out = []
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            out.append(p)
    return out


def get_version_from_binary(bin_path):
    out = run_cmd([bin_path, '--version'])
    if out:
        return parse_version(out), out
    return None, None


def get_version_windows_registry():
    if platform.system().lower() != 'windows':
        return None, None
    reg_paths = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon'
    ]
    for reg_path in reg_paths:
        out = run_cmd(['reg', 'query', reg_path, '/v', 'version'])
        if out:
            v = parse_version(out)
            if v:
                return v, out
    return None, None


def main():
    parser = argparse.ArgumentParser(description='Check local Chrome version for CVE-2026-11244')
    parser.add_argument('--path', help='Explicit path to Chrome binary')
    parser.add_argument('--version', help='Explicit version string to test, e.g. 149.0.7827.52')
    args = parser.parse_args()

    if args.version:
        v = parse_version(args.version)
        if not v:
            print('UNKNOWN: could not parse supplied version string')
            sys.exit(2)
        if cmp_versions(v, PATCHED_VERSION) < 0:
            print(f'VULNERABLE: supplied version {args.version} is older than 149.0.7827.53')
            sys.exit(1)
        print(f'PATCHED: supplied version {args.version} is at or above 149.0.7827.53')
        sys.exit(0)

    checked = []

    if args.path:
        checked.append(args.path)
        v, raw = get_version_from_binary(args.path)
        if v:
            if cmp_versions(v, PATCHED_VERSION) < 0:
                print(f'VULNERABLE: {args.path} -> {raw}')
                sys.exit(1)
            print(f'PATCHED: {args.path} -> {raw}')
            sys.exit(0)
        print(f'UNKNOWN: could not execute or parse version from {args.path}')
        sys.exit(2)

    if platform.system().lower() == 'windows':
        v, raw = get_version_windows_registry()
        if v:
            if cmp_versions(v, PATCHED_VERSION) < 0:
                print(f'VULNERABLE: registry reports Chrome version {v[0]}.{v[1]}.{v[2]}.{v[3]}')
                sys.exit(1)
            print(f'PATCHED: registry reports Chrome version {v[0]}.{v[1]}.{v[2]}.{v[3]}')
            sys.exit(0)

    for path in candidate_paths():
        checked.append(path)
        if os.path.exists(path):
            v, raw = get_version_from_binary(path)
            if v:
                if cmp_versions(v, PATCHED_VERSION) < 0:
                    print(f'VULNERABLE: {path} -> {raw}')
                    sys.exit(1)
                print(f'PATCHED: {path} -> {raw}')
                sys.exit(0)

    if checked:
        print('UNKNOWN: Chrome not found or version could not be parsed. Checked: ' + ', '.join(checked))
    else:
        print('UNKNOWN: no Chrome candidates found')
    sys.exit(2)


if __name__ == '__main__':
    main()