Insufficient policy enforcement in Password Manager in Google Chrome prior to 149

#!/usr/bin/env python3
# Check Google Chrome version for CVE-2026-11251
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

TARGET = (149, 0, 7827, 53)

def norm(ver):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', ver or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())

def cmp_ver(a, b):
    return (a > b) - (a < b)

def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None

def detect_from_arg():
    if '--path' in sys.argv:
        try:
            idx = sys.argv.index('--path')
            path = sys.argv[idx + 1]
            out = run_cmd([path, '--version'])
            if out:
                return ('path', out)
        except Exception:
            return ('path', None)
    return None

def detect_linux():
    candidates = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'
    ]
    for c in candidates:
        out = run_cmd([c, '--version'])
        if out and 'Chrome' in out or out and 'Chromium' in out:
            return (c, out)
    return (None, None)

def detect_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
    ]
    for c in candidates:
        if os.path.exists(c):
            out = run_cmd([c, '--version'])
            if out:
                return (c, out)
    return (None, None)

def detect_windows():
    candidates = []
    for base in [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]:
        if base:
            candidates.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    for c in candidates:
        if c and os.path.exists(c):
            ps = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{c}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(ps)
            if out:
                return (c, out)
    try:
        import winreg  # type: ignore
        keys = [
            r'SOFTWARE\Google\Chrome\BLBeacon',
            r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon'
        ]
        for hive in [winreg.HKEY_CURRENT_USER, winreg.HKEY_LOCAL_MACHINE]:
            for key in keys:
                try:
                    with winreg.OpenKey(hive, key) as k:
                        version, _ = winreg.QueryValueEx(k, 'version')
                        if version:
                            return ('registry', version)
                except Exception:
                    pass
    except Exception:
        pass
    return (None, None)

def main():
    res = detect_from_arg()
    if res:
        source, out = res
    else:
        system = platform.system().lower()
        if system == 'windows':
            source, out = detect_windows()
        elif system == 'darwin':
            source, out = detect_macos()
        else:
            source, out = detect_linux()

    if not out:
        print('UNKNOWN - Could not detect Chrome/Chromium version')
        sys.exit(2)

    ver = norm(out)
    if not ver:
        print(f'UNKNOWN - Unparseable version string from {source}: {out}')
        sys.exit(2)

    if cmp_ver(ver, TARGET) < 0:
        print(f'VULNERABLE - Detected version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} < 149.0.7827.53')
        sys.exit(1)
    else:
        print(f'PATCHED - Detected version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} >= 149.0.7827.53')
        sys.exit(0)

if __name__ == '__main__':
    main()