Google Chrome Content Security Policy policy bypass via crafted HTML page

#!/usr/bin/env python3
# CVE-2026-11264 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from typing import List, Optional, Tuple

FIXED = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, ...]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v: Tuple[int, ...]) -> str:
    return '.'.join(str(x) for x in v)


def compare_versions(a: Tuple[int, ...], b: Tuple[int, ...]) -> int:
    la = list(a)
    lb = list(b)
    maxlen = max(len(la), len(lb))
    la += [0] * (maxlen - len(la))
    lb += [0] * (maxlen - len(lb))
    if la < lb:
        return -1
    if la > lb:
        return 1
    return 0


def run_and_get_version(cmd: List[str]) -> Optional[Tuple[int, ...]]:
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=5)
        return parse_version(out.strip())
    except Exception:
        return None


def windows_candidates() -> List[List[str]]:
    candidates = []
    env_paths = [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData'),
    ]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
        r'Chromium\Application\chrome.exe',
    ]
    for base in env_paths:
        if not base:
            continue
        for suffix in suffixes:
            full = os.path.join(base, suffix)
            if os.path.exists(full):
                candidates.append([full, '--version'])
    return candidates


def mac_candidates() -> List[List[str]]:
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ]
    return [[p, '--version'] for p in paths if os.path.exists(p)]


def linux_candidates() -> List[List[str]]:
    names = [
        'google-chrome',
        'google-chrome-stable',
        'chromium',
        'chromium-browser',
    ]
    return [[n, '--version'] for n in names]


def collect_versions() -> List[Tuple[str, Tuple[int, ...]]]:
    found = []
    system = platform.system().lower()
    if 'windows' in system:
        cmds = windows_candidates()
    elif 'darwin' in system:
        cmds = mac_candidates()
    else:
        cmds = linux_candidates()

    seen = set()
    for cmd in cmds:
        key = ' '.join(cmd)
        if key in seen:
            continue
        seen.add(key)
        version = run_and_get_version(cmd)
        if version:
            found.append((cmd[0], version))
    return found


def main() -> int:
    versions = collect_versions()
    if not versions:
        print('UNKNOWN: Chrome/Chromium not found or version not readable')
        return 2

    vulnerable = []
    patched = []
    for path, version in versions:
        if compare_versions(version, FIXED) < 0:
            vulnerable.append((path, version))
        else:
            patched.append((path, version))

    for path, version in versions:
        status = 'VULNERABLE' if compare_versions(version, FIXED) < 0 else 'PATCHED'
        print(f'{status}: {path} -> {version_to_str(version)}')

    if vulnerable:
        print(f'VULNERABLE: one or more installed browsers are below fixed version {version_to_str(FIXED)}')
        return 1

    print(f'PATCHED: all detected browsers meet or exceed fixed version {version_to_str(FIXED)}')
    return 0


if __name__ == '__main__':
    sys.exit(main())