Side-channel information leakage in Paint in Google Chrome prior to 149

#!/usr/bin/env python3
# check_chrome_cve_2026_11289.py
# Detects whether local Google Chrome is vulnerable to CVE-2026-11289
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def windows_paths():
    candidates = []
    for base in [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]:
        if not base:
            continue
        candidates.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    return candidates


def mac_paths():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]


def linux_paths():
    paths = []
    for name in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']:
        p = which(name)
        if p:
            paths.append(p)
    paths.extend([
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/opt/google/chrome/chrome',
        '/snap/bin/chromium',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
    ])
    # dedupe while preserving order
    seen = set()
    out = []
    for p in paths:
        if p not in seen:
            seen.add(p)
            out.append(p)
    return out


def detect_version():
    system = platform.system().lower()
    candidates = []

    if 'windows' in system:
        candidates = windows_paths()
    elif 'darwin' in system:
        candidates = mac_paths()
    else:
        candidates = linux_paths()

    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return path, ver, out

    # Fallback for Windows registry via PowerShell if binary path was not found
    if 'windows' in system:
        ps = which('powershell') or which('pwsh')
        if ps:
            script = r"""
$paths = @(
 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
)
foreach ($p in $paths) {
  try {
    $item = Get-ItemProperty -Path $p -ErrorAction Stop
    if ($item.'(default)') { Write-Output $item.'(default)'; break }
  } catch {}
}
"""
            chrome_path = run_cmd([ps, '-NoProfile', '-Command', script])
            if chrome_path and os.path.exists(chrome_path.strip()):
                out = run_cmd([chrome_path.strip(), '--version'])
                ver = parse_version(out)
                if ver:
                    return chrome_path.strip(), ver, out

    return None, None, None


def main():
    path, ver, raw = detect_version()
    if not ver:
        print('UNKNOWN')
        sys.exit(2)

    if cmp_ver(ver, THRESHOLD) < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()