Google Chrome Passwords UI spoofing via crafted HTML page

#!/usr/bin/env python3
# Check Chrome/Chromium version exposure for CVE-2026-11294
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=5)
        return out.strip()
    except Exception:
        return None


def windows_candidates():
    candidates = []
    envs = [
        os.environ.get('PROGRAMFILES'),
        os.environ.get('PROGRAMFILES(X86)'),
        os.environ.get('LOCALAPPDATA'),
    ]
    suffixes = [
        r'Google\\Chrome\\Application\\chrome.exe',
        r'Chromium\\Application\\chrome.exe',
    ]
    for base in envs:
        if not base:
            continue
        for suf in suffixes:
            p = os.path.join(base, *suf.split('\\'))
            if os.path.exists(p):
                candidates.append(p)
    return candidates


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        os.path.expanduser('~/Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]


def linux_candidates():
    bins = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome'
    ]
    found = []
    for b in bins:
        p = shutil.which(b)
        if p:
            found.append(p)
    return found


def detect_versions():
    system = platform.system().lower()
    candidates = []
    if 'windows' in system:
        candidates = windows_candidates()
    elif 'darwin' in system:
        candidates = mac_candidates()
    else:
        candidates = linux_candidates()

    seen = []
    for path in candidates:
        if not os.path.exists(path) and not shutil.which(path):
            continue
        out = run_cmd([path, '--version'])
        if not out:
            continue
        ver = parse_version(out)
        if ver:
            seen.append((path, ver, out))
    return seen


def main():
    seen = detect_versions()
    if not seen:
        print('UNKNOWN: could not determine installed Chrome/Chromium version')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver, raw in seen:
        if cmp_ver(ver, THRESHOLD) < 0:
            vulnerable.append((path, ver, raw))
        else:
            patched.append((path, ver, raw))

    if vulnerable:
        details = '; '.join([f'{p}={".".join(map(str, v))}' for p, v, _ in vulnerable])
        print(f'VULNERABLE: found version(s) below 149.0.7827.53 -> {details}')
        sys.exit(1)

    details = '; '.join([f'{p}={".".join(map(str, v))}' for p, v, _ in patched])
    print(f'PATCHED: found version(s) at or above 149.0.7827.53 -> {details}')
    sys.exit(0)


if __name__ == '__main__':
    main()