Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11266.py
# Detects local Google Chrome / Chromium versions against CVE-2026-11266 fixed version.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from typing import List, Optional, Tuple

FIXED = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a: Tuple[int, int, int, int], b: Tuple[int, int, int, int]) -> int:
    return (a > b) - (a < b)


def run_version_cmd(cmd: List[str]) -> Optional[str]:
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        out = (p.stdout or '').strip()
        return out if out else None
    except Exception:
        return None


def check_windows() -> List[Tuple[str, Optional[Tuple[int, int, int, int]], str]]:
    results = []
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles%\Chromium\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Chromium\Application\chrome.exe'),
    ]
    ps = 'powershell'
    for path in candidates:
        if os.path.exists(path):
            cmd = [ps, '-NoProfile', '-Command', f"(Get-Item '{path.replace("'", "''")}').VersionInfo.ProductVersion"]
            out = run_version_cmd(cmd)
            ver = parse_version(out or '')
            results.append((path, ver, out or ''))
    return results


def check_macos() -> List[Tuple[str, Optional[Tuple[int, int, int, int]], str]]:
    results = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        os.path.expanduser('~/Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_version_cmd([path, '--version'])
            ver = parse_version(out or '')
            results.append((path, ver, out or ''))
    return results


def check_linux() -> List[Tuple[str, Optional[Tuple[int, int, int, int]], str]]:
    results = []
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium', '--version'],
        ['chromium-browser', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
        ['/usr/bin/google-chrome', '--version'],
        ['/usr/bin/chromium', '--version'],
        ['/usr/bin/chromium-browser', '--version'],
    ]
    seen = set()
    for cmd in candidates:
        key = tuple(cmd)
        if key in seen:
            continue
        seen.add(key)
        out = run_version_cmd(cmd)
        if out:
            ver = parse_version(out)
            results.append((' '.join(cmd), ver, out))
    return results


def main() -> int:
    system = platform.system().lower()
    if 'windows' in system:
        findings = check_windows()
    elif 'darwin' in system:
        findings = check_macos()
    else:
        findings = check_linux()

    if not findings:
        print('UNKNOWN: Chrome/Chromium not found in common locations')
        return 2

    vulnerable = []
    patched = []
    unknown = []

    for loc, ver, raw in findings:
        if ver is None:
            unknown.append((loc, raw))
        elif cmp_ver(ver, FIXED) < 0:
            vulnerable.append((loc, ver))
        else:
            patched.append((loc, ver))

    if vulnerable:
        details = '; '.join([f'{loc}={".".join(map(str, ver))}' for loc, ver in vulnerable])
        print(f'VULNERABLE: {details} (fixed version: 149.0.7827.53+)')
        return 1

    if patched and not unknown:
        details = '; '.join([f'{loc}={".".join(map(str, ver))}' for loc, ver in patched])
        print(f'PATCHED: {details}')
        return 0

    if patched:
        details = '; '.join([f'{loc}={".".join(map(str, ver))}' for loc, ver in patched])
        print(f'PATCHED: {details} | Note: some installs could not be versioned')
        return 0

    print('UNKNOWN: Browser found but version could not be parsed')
    return 2


if __name__ == '__main__':
    sys.exit(main())