Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149

#!/usr/bin/env python3
# check_cve_2026_11287.py
# Determine exposure to CVE-2026-11287 from an inventory CSV.
# Expected input: a CSV containing at least a package column and a version column.
# Default package name checked: com.android.chrome
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import csv
import re
import sys
from typing import List, Optional, Tuple

FIXED_VERSION = "149.0.7827.53"
DEFAULT_PACKAGE = "com.android.chrome"


def parse_version(v: str) -> Optional[Tuple[int, ...]]:
    if v is None:
        return None
    parts = re.findall(r"\d+", v)
    if not parts:
        return None
    return tuple(int(p) for p in parts)


def cmp_version(a: str, b: str) -> Optional[int]:
    va = parse_version(a)
    vb = parse_version(b)
    if va is None or vb is None:
        return None
    max_len = max(len(va), len(vb))
    va = va + (0,) * (max_len - len(va))
    vb = vb + (0,) * (max_len - len(vb))
    if va < vb:
        return -1
    if va > vb:
        return 1
    return 0


def main() -> int:
    ap = argparse.ArgumentParser(description="Check inventory CSV for CVE-2026-11287 exposure")
    ap.add_argument("csv_file", help="Path to inventory CSV export")
    ap.add_argument("--package-column", default="package", help="CSV column containing package name (default: package)")
    ap.add_argument("--version-column", default="version", help="CSV column containing installed version (default: version)")
    ap.add_argument("--device-column", default="device", help="CSV column containing device identifier (default: device)")
    ap.add_argument("--package-name", default=DEFAULT_PACKAGE, help="Android package name to evaluate (default: com.android.chrome)")
    args = ap.parse_args()

    vulnerable: List[str] = []
    patched: List[str] = []
    unknown: List[str] = []
    found_rows = 0

    try:
        with open(args.csv_file, newline="", encoding="utf-8-sig") as fh:
            reader = csv.DictReader(fh)
            if reader.fieldnames is None:
                print("UNKNOWN - CSV has no header row")
                return 2

            required = {args.package_column, args.version_column}
            missing = [c for c in required if c not in reader.fieldnames]
            if missing:
                print(f"UNKNOWN - missing required column(s): {', '.join(missing)}")
                return 2

            for row in reader:
                pkg = (row.get(args.package_column) or "").strip()
                if pkg != args.package_name:
                    continue

                found_rows += 1
                device = (row.get(args.device_column) or f"row-{found_rows}").strip()
                ver = (row.get(args.version_column) or "").strip()
                result = cmp_version(ver, FIXED_VERSION)

                if result is None:
                    unknown.append(f"{device}:{ver or 'NO_VERSION'}")
                elif result < 0:
                    vulnerable.append(f"{device}:{ver}")
                else:
                    patched.append(f"{device}:{ver}")

    except FileNotFoundError:
        print(f"UNKNOWN - file not found: {args.csv_file}")
        return 2
    except Exception as exc:
        print(f"UNKNOWN - failed to process CSV: {exc}")
        return 2

    if found_rows == 0:
        print(f"UNKNOWN - no rows found for package {args.package_name}")
        return 2

    if vulnerable:
        print("VULNERABLE")
        print(f"fixed_version={FIXED_VERSION}")
        print(f"vulnerable_count={len(vulnerable)}")
        print(f"patched_count={len(patched)}")
        print(f"unknown_count={len(unknown)}")
        for item in vulnerable[:50]:
            print(item)
        if len(vulnerable) > 50:
            print(f"... {len(vulnerable) - 50} more vulnerable devices omitted")
        return 1

    if unknown and not patched:
        print("UNKNOWN")
        print(f"fixed_version={FIXED_VERSION}")
        print(f"unknown_count={len(unknown)}")
        for item in unknown[:50]:
            print(item)
        if len(unknown) > 50:
            print(f"... {len(unknown) - 50} more unknown devices omitted")
        return 2

    print("PATCHED")
    print(f"fixed_version={FIXED_VERSION}")
    print(f"patched_count={len(patched)}")
    print(f"unknown_count={len(unknown)}")
    if unknown:
        print("note=some devices had unparseable versions; review separately")
        for item in unknown[:50]:
            print(item)
        if len(unknown) > 50:
            print(f"... {len(unknown) - 50} more unknown devices omitted")
    return 0


if __name__ == "__main__":
    sys.exit(main())