Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149

#!/usr/bin/env python3
# check_cve_2026_11277.py
# Determine exposure to CVE-2026-11277 from an MDM/exported mobile app inventory CSV.
# Outputs one overall status: VULNERABLE / PATCHED / UNKNOWN
# Exit codes:
#   0 = PATCHED (all detected Chrome for iOS installs are >= 149.0.7827.53)
#   1 = VULNERABLE (at least one detected Chrome for iOS install is < 149.0.7827.53)
#   2 = UNKNOWN (no usable Chrome for iOS rows found or version parsing failed)

import csv
import sys
import re

FIXED = (149, 0, 7827, 53)
CHROME_NAMES = {
    'google chrome',
    'chrome',
    'chrome for ios'
}
CHROME_BUNDLES = {
    'com.google.chrome.ios',
    'com.google.chrome'
}


def norm(s):
    return (s or '').strip().lower()


def parse_version(v):
    if not v:
        return None
    nums = re.findall(r'\d+', str(v))
    if not nums:
        return None
    parts = tuple(int(x) for x in nums[:4])
    if len(parts) < 4:
        parts = parts + (0,) * (4 - len(parts))
    return parts


def version_lt(a, b):
    return a < b


def pick(row, candidates):
    for c in candidates:
        if c in row and row[c] not in (None, ''):
            return row[c]
    return ''


def is_chrome_ios(row):
    app_name = norm(pick(row, ['app_name', 'application', 'name', 'app']))
    bundle_id = norm(pick(row, ['bundle_id', 'package', 'package_name', 'bundle']))
    platform = norm(pick(row, ['platform', 'os', 'device_os']))

    name_match = app_name in CHROME_NAMES or ('chrome' in app_name and 'ios' in app_name)
    bundle_match = bundle_id in CHROME_BUNDLES
    ios_hint = ('ios' in platform) or ('iphone' in platform) or ('ipad' in platform) or platform == ''

    return ios_hint and (name_match or bundle_match)


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2026_11277.py <inventory.csv>')
        sys.exit(2)

    path = sys.argv[1]
    vulnerable = []
    patched = []
    unknown = []
    matched_rows = 0

    try:
        with open(path, newline='', encoding='utf-8-sig') as f:
            reader = csv.DictReader(f)
            if not reader.fieldnames:
                print('UNKNOWN - CSV has no headers')
                sys.exit(2)

            for row in reader:
                if not is_chrome_ios(row):
                    continue

                matched_rows += 1
                device = pick(row, ['device_name', 'hostname', 'device', 'name', 'serial_number']) or 'unknown-device'
                version_raw = pick(row, ['app_version', 'version', 'application_version'])
                version = parse_version(version_raw)

                if version is None:
                    unknown.append((device, version_raw))
                elif version_lt(version, FIXED):
                    vulnerable.append((device, version_raw))
                else:
                    patched.append((device, version_raw))

    except FileNotFoundError:
        print(f'UNKNOWN - file not found: {path}')
        sys.exit(2)
    except Exception as e:
        print(f'UNKNOWN - failed to read CSV: {e}')
        sys.exit(2)

    if vulnerable:
        print('VULNERABLE')
        print(f'Affected Chrome for iOS installs below 149.0.7827.53: {len(vulnerable)}')
        for device, version in vulnerable[:50]:
            print(f'  {device}: {version}')
        if len(vulnerable) > 50:
            print(f'  ... {len(vulnerable) - 50} more')
        sys.exit(1)

    if matched_rows == 0:
        print('UNKNOWN - no Chrome for iOS rows found in inventory')
        sys.exit(2)

    if unknown and not patched:
        print('UNKNOWN')
        print(f'Chrome for iOS rows found, but version could not be parsed for {len(unknown)} device(s)')
        for device, version in unknown[:50]:
            print(f'  {device}: {version}')
        sys.exit(2)

    print('PATCHED')
    print(f'Patched Chrome for iOS installs at or above 149.0.7827.53: {len(patched)}')
    if unknown:
        print(f'Warning: version unknown on {len(unknown)} additional device(s)')
    sys.exit(0)


if __name__ == '__main__':
    main()