Insufficient policy enforcement in Content Settings in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11252.py
# Detects whether Google Chrome is older than the fixed version for CVE-2026-11252.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import plistlib
import re
import shutil
import subprocess
import sys
from pathlib import Path

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        pass
    return None


def check_windows():
    candidates = [
        Path(os.environ.get('ProgramFiles', '')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('ProgramFiles(x86)', '')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('LocalAppData', '')) / 'Google/Chrome/Application/chrome.exe',
    ]

    found = []
    for p in candidates:
        if p and p.exists():
            found.append(str(p))

    ps = shutil.which('powershell') or shutil.which('pwsh')
    for exe in found:
        if ps:
            script = f"(Get-Item '{exe}').VersionInfo.ProductVersion"
            out = run_cmd([ps, '-NoProfile', '-Command', script])
            v = parse_version(out)
            if v:
                return v, exe

    reg_queries = [
        r'HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        r'HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        r'HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
    ]
    reg = shutil.which('reg')
    if reg:
        for key in reg_queries:
            out = run_cmd([reg, 'query', key, '/ve'])
            if out:
                v = parse_version(out)
                if v:
                    return v, key

    return None, None


def check_macos():
    app = Path('/Applications/Google Chrome.app/Contents/Info.plist')
    if app.exists():
        try:
            with app.open('rb') as f:
                plist = plistlib.load(f)
            ver = plist.get('KSVersion') or plist.get('CFBundleShortVersionString')
            v = parse_version(ver)
            if v:
                return v, str(app)
        except Exception:
            pass

    chrome_bin = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if Path(chrome_bin).exists():
        out = run_cmd([chrome_bin, '--version'])
        v = parse_version(out)
        if v:
            return v, chrome_bin

    return None, None


def check_linux():
    names = ['google-chrome', 'google-chrome-stable', 'chromium-browser', 'chromium']
    for name in names:
        binpath = shutil.which(name)
        if binpath:
            out = run_cmd([binpath, '--version'])
            v = parse_version(out)
            if v:
                return v, binpath

    package_cmds = [
        ['dpkg-query', '-W', '-f=${Version}', 'google-chrome-stable'],
        ['rpm', '-q', '--qf', '%{VERSION}-%{RELEASE}', 'google-chrome-stable'],
    ]
    for cmd in package_cmds:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, 'package-manager'

    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'windows' in system:
        version, source = check_windows()
    elif 'darwin' in system:
        version, source = check_macos()
    elif 'linux' in system:
        version, source = check_linux()
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not version:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    if ver_lt(version, TARGET):
        print(f'VULNERABLE: found Chrome {".".join(map(str, version))} via {source}; fixed version is >= {".".join(map(str, TARGET))}')
        sys.exit(1)
    else:
        print(f'PATCHED: found Chrome {".".join(map(str, version))} via {source}; fixed version is >= {".".join(map(str, TARGET))}')
        sys.exit(0)


if __name__ == '__main__':
    main()