Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149

#!/usr/bin/env python3
# chrome_cve_2026_11273_check.py
# Detect exposure to CVE-2026-11273 by checking installed Google Chrome version.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

PATCH_LINUX = (149, 0, 7827, 53)
PATCH_WIN_MAC = (149, 0, 7827, 53)  # .53/.54 both considered fixed; anything >= .53 is acceptable.


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_versions(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_paths():
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        envs = [
            os.environ.get('ProgramFiles'),
            os.environ.get('ProgramFiles(x86)'),
            os.environ.get('LocalAppData'),
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe',
        ]
        for base in envs:
            if base:
                for s in suffixes:
                    paths.append(Path(base) / s)
    elif system == 'darwin':
        paths.extend([
            Path('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            Path('/Applications/Chromium.app/Contents/MacOS/Chromium'),
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            p = shutil.which(name)
            if p:
                paths.append(Path(p))
        paths.extend([
            Path('/opt/google/chrome/chrome'),
            Path('/usr/bin/google-chrome'),
            Path('/usr/bin/google-chrome-stable'),
            Path('/usr/bin/chromium'),
            Path('/usr/bin/chromium-browser'),
        ])

    # Deduplicate while preserving order
    seen = set()
    uniq = []
    for p in paths:
        s = str(p)
        if s not in seen:
            seen.add(s)
            uniq.append(p)
    return uniq


def get_version_from_binary(path):
    if not path.exists():
        return None, ''
    out = run_cmd([str(path), '--version'])
    ver = parse_version(out)
    return ver, out


def get_windows_registry_version():
    reg_paths = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon',
    ]
    for reg in reg_paths:
        out = run_cmd(['reg', 'query', reg, '/v', 'version'])
        ver = parse_version(out)
        if ver:
            return ver, out
    return None, ''


def classify(ver):
    system = platform.system().lower()
    if system == 'linux':
        return 'PATCHED' if compare_versions(ver, PATCH_LINUX) >= 0 else 'VULNERABLE'
    return 'PATCHED' if compare_versions(ver, PATCH_WIN_MAC) >= 0 else 'VULNERABLE'


def main():
    findings = []

    if platform.system().lower() == 'windows':
        ver, raw = get_windows_registry_version()
        if ver:
            findings.append(('registry', ver, raw))

    for path in candidate_paths():
        ver, raw = get_version_from_binary(path)
        if ver:
            findings.append((str(path), ver, raw))

    # Deduplicate by path/source and version
    normalized = []
    seen = set()
    for src, ver, raw in findings:
        key = (src, ver)
        if key not in seen:
            seen.add(key)
            normalized.append((src, ver, raw))

    if not normalized:
        print('UNKNOWN: Could not determine a local Chrome/Chromium version from standard paths or registry.')
        sys.exit(2)

    statuses = []
    for src, ver, raw in normalized:
        status = classify(ver)
        statuses.append(status)
        print(f'{status}: {src} -> {".".join(map(str, ver))}')

    if 'VULNERABLE' in statuses:
        sys.exit(1)
    if 'PATCHED' in statuses:
        sys.exit(0)

    print('UNKNOWN: Version data found but could not be classified.')
    sys.exit(2)


if __name__ == '__main__':
    main()