Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149

#!/usr/bin/env python3
# verify_cve_2026_11286.py
# Checks local Google Chrome / Chromium version against fixed build for CVE-2026-11286.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def compare(v1, v2):
    return (v1 > v2) - (v1 < v2)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def find_windows_version():
    commands = [
        ['reg', 'query', r'HKLM\Software\Google\Chrome\BLBeacon', '/v', 'version'],
        ['reg', 'query', r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon', '/v', 'version'],
        ['reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'],
        ['powershell', '-NoProfile', '-Command', r"(Get-ItemProperty 'HKLM:\Software\Google\Chrome\BLBeacon' -ErrorAction SilentlyContinue).version"],
        ['powershell', '-NoProfile', '-Command', r"(Get-ItemProperty 'HKLM:\Software\WOW6432Node\Google\Chrome\BLBeacon' -ErrorAction SilentlyContinue).version"],
        ['powershell', '-NoProfile', '-Command', r"(Get-ItemProperty 'HKCU:\Software\Google\Chrome\BLBeacon' -ErrorAction SilentlyContinue).version"],
    ]
    for cmd in commands:
        out = run_cmd(cmd)
        v = parse_version(out or '')
        if v:
            return ('Google Chrome', v)

    paths = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles%\Chromium\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Chromium\Application\chrome.exe'),
    ]
    for p in paths:
        if p and os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out or '')
            if v:
                name = 'Chromium' if 'Chromium' in (out or '') else 'Google Chrome'
                return (name, v)
    return None


def find_macos_version():
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ]
    for p in paths:
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out or '')
            if v:
                name = 'Chromium' if 'Chromium' in (out or '') else 'Google Chrome'
                return (name, v)
    return None


def find_linux_version():
    commands = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium', '--version'],
        ['chromium-browser', '--version'],
    ]
    for cmd in commands:
        out = run_cmd(cmd)
        v = parse_version(out or '')
        if v:
            name = 'Chromium' if 'Chromium' in (out or '') else 'Google Chrome'
            return (name, v)
    return None


def main():
    system = platform.system().lower()
    result = None

    if 'windows' in system:
        result = find_windows_version()
    elif 'darwin' in system:
        result = find_macos_version()
    else:
        result = find_linux_version()

    if not result:
        print('UNKNOWN: Chrome/Chromium version could not be determined on this host')
        sys.exit(2)

    name, version = result
    if compare(version, FIXED) < 0:
        print(f'VULNERABLE: {name} {version_to_str(version)} < fixed {version_to_str(FIXED)}')
        sys.exit(1)
    else:
        print(f'PATCHED: {name} {version_to_str(version)} >= fixed {version_to_str(FIXED)}')
        sys.exit(0)


if __name__ == '__main__':
    main()