Use after free in Input in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_11293.py
# Detect vulnerable Google Chrome / Chromium versions for CVE-2026-11293
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

THRESHOLD = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd: List[str]) -> Optional[str]:
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return None


def existing_paths(candidates: List[str]) -> List[str]:
    seen = []
    for p in candidates:
        if p and os.path.exists(p) and p not in seen:
            seen.append(p)
    return seen


def candidate_binaries() -> List[str]:
    system = platform.system().lower()
    cands = []

    # PATH hits first
    for name in [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser',
        'chrome', 'msedge'  # included only if org reuses script pattern; result is still versioned output
    ]:
        p = shutil.which(name)
        if p:
            cands.append(p)

    if system == 'windows':
        for env in ['ProgramFiles', 'ProgramFiles(x86)', 'LocalAppData']:
            base = os.environ.get(env)
            if not base:
                continue
            cands.extend([
                os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'),
                os.path.join(base, 'Chromium', 'Application', 'chrome.exe')
            ])
    elif system == 'darwin':
        cands.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            os.path.expanduser('~/Applications/Chromium.app/Contents/MacOS/Chromium')
        ])
    else:
        cands.extend([
            '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium', '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ])

    return existing_paths(cands)


def compare_versions(found: Tuple[int, int, int, int], threshold: Tuple[int, int, int, int]) -> int:
    if found < threshold:
        return -1
    if found == threshold:
        return 0
    return 1


def main() -> int:
    bins = candidate_binaries()
    if not bins:
        print('UNKNOWN: no Chrome/Chromium binary found')
        return 2

    results = []
    for b in bins:
        out = run_version([b, '--version'])
        ver = parse_version(out or '')
        if ver:
            results.append((b, ver, out.strip()))

    if not results:
        print('UNKNOWN: Chrome/Chromium found but version could not be determined')
        return 2

    vulnerable = []
    patched = []
    for path, ver, raw in results:
        cmpv = compare_versions(ver, THRESHOLD)
        item = {'path': path, 'version': '.'.join(map(str, ver)), 'raw': raw}
        if cmpv < 0:
            vulnerable.append(item)
        else:
            patched.append(item)

    if vulnerable:
        print('VULNERABLE')
        for item in vulnerable:
            print(f"{item['path']} -> {item['version']}")
        if patched:
            print('INFO: patched binaries also present:')
            for item in patched:
                print(f"{item['path']} -> {item['version']}")
        return 1

    print('PATCHED')
    for item in patched:
        print(f"{item['path']} -> {item['version']}")
    return 0


if __name__ == '__main__':
    sys.exit(main())