Inappropriate implementation in Autofill in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11265.py
# Determine whether installed Google Chrome is vulnerable to CVE-2026-11265.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_and_get_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=5)
        out = (p.stdout or '').strip()
        v = parse_version(out)
        if v:
            return v, out, ' '.join(cmd)
    except Exception:
        pass
    return None, None, None


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        pf = os.environ.get('PROGRAMFILES', '')
        pf86 = os.environ.get('PROGRAMFILES(X86)', '')
        paths = [
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pf86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for p in paths:
            if p and os.path.exists(p):
                cmds.append([p, '--version'])
        for name in ['chrome', 'google-chrome', 'google-chrome-stable']:
            resolved = shutil.which(name)
            if resolved:
                cmds.append([resolved, '--version'])

    elif system == 'darwin':
        mac_paths = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for p in mac_paths:
            if os.path.exists(p):
                cmds.append([p, '--version'])
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            resolved = shutil.which(name)
            if resolved:
                cmds.append([resolved, '--version'])

    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            resolved = shutil.which(name)
            if resolved:
                cmds.append([resolved, '--version'])
        linux_paths = [
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
        ]
        for p in linux_paths:
            if os.path.exists(p):
                cmds.append([p, '--version'])

    # Deduplicate while preserving order
    seen = set()
    uniq = []
    for cmd in cmds:
        key = tuple(cmd)
        if key not in seen:
            seen.add(key)
            uniq.append(cmd)
    return uniq


def main():
    cmds = candidate_commands()
    if not cmds:
        print('UNKNOWN - Chrome executable not found in common locations')
        sys.exit(2)

    found = []
    for cmd in cmds:
        v, raw, used = run_and_get_version(cmd)
        if v:
            found.append((v, raw, used))

    if not found:
        print('UNKNOWN - Could not determine Chrome version from discovered executables')
        sys.exit(2)

    # Use the highest discovered version; multiple channels may coexist.
    found.sort(key=lambda x: x[0], reverse=True)
    version, raw, used = found[0]
    version_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in FIXED_VERSION)

    if cmp_ver(version, FIXED_VERSION) < 0:
        print(f'VULNERABLE - Found version {version_str} via [{used}] ; fixed version is {fixed_str} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - Found version {version_str} via [{used}] ; fixed threshold is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()