Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149

#!/usr/bin/env python3
# check_chrome_ios_cve_2026_11298.py
#
# Determine whether managed devices are vulnerable to CVE-2026-11298
# based on Chrome for iOS app version inventory.
#
# Expected CSV columns (case-insensitive, any subset that helps):
#   device_id, device_name, platform, bundle_id, app_name, version
#
# Logic:
#   - Only rows that appear to be Google Chrome on iOS are evaluated.
#   - Version < 149.0.7827.53 => VULNERABLE
#   - Version >= 149.0.7827.53 => PATCHED
#   - Missing/invalid version or no matching rows => UNKNOWN
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage / parse issues

import csv
import re
import sys
from pathlib import Path

FIXED_VERSION = (149, 0, 7827, 53)
IOS_HINTS = {"ios", "ipados", "iphone", "ipad"}
CHROME_BUNDLE_IDS = {
    "com.google.chrome.ios",
    "com.google.chrome.ios.beta",
}


def norm(s):
    return (s or "").strip().lower()


def parse_version(text):
    if not text:
        return None
    nums = re.findall(r"\d+", text)
    if not nums:
        return None
    parts = [int(x) for x in nums[:4]]
    while len(parts) < 4:
        parts.append(0)
    return tuple(parts)


def is_ios_row(row):
    platform = norm(row.get("platform", ""))
    if any(h in platform for h in IOS_HINTS):
        return True
    return False


def is_chrome_ios_row(row):
    bundle_id = norm(row.get("bundle_id", ""))
    app_name = norm(row.get("app_name", ""))
    platform = norm(row.get("platform", ""))

    bundle_match = bundle_id in CHROME_BUNDLE_IDS or bundle_id.startswith("com.google.chrome.ios")
    name_match = ("chrome" in app_name and "google" in app_name) or app_name == "chrome"
    ios_match = any(h in platform for h in IOS_HINTS) or bundle_match

    return ios_match and (bundle_match or name_match)


def compare_versions(a, b):
    return (a > b) - (a < b)


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_chrome_ios_cve_2026_11298.py <inventory.csv>")
        sys.exit(2)

    csv_path = Path(sys.argv[1])
    if not csv_path.exists():
        print(f"UNKNOWN - file not found: {csv_path}")
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []
    matched_any = False

    try:
        with csv_path.open("r", encoding="utf-8-sig", newline="") as fh:
            reader = csv.DictReader(fh)
            if not reader.fieldnames:
                print("UNKNOWN - CSV has no header row")
                sys.exit(2)

            # normalize headers
            reader.fieldnames = [norm(h) for h in reader.fieldnames]

            for raw_row in reader:
                row = {norm(k): (v or "").strip() for k, v in raw_row.items()}
                if not is_chrome_ios_row(row):
                    continue

                matched_any = True
                device = row.get("device_id") or row.get("device_name") or "unknown-device"
                version_text = row.get("version", "")
                version = parse_version(version_text)

                if version is None:
                    unknown.append((device, version_text or "<missing>"))
                    continue

                if compare_versions(version, FIXED_VERSION) < 0:
                    vulnerable.append((device, version_text))
                else:
                    patched.append((device, version_text))

    except Exception as exc:
        print(f"UNKNOWN - failed to parse CSV: {exc}")
        sys.exit(2)

    if not matched_any:
        print("UNKNOWN - no Chrome for iOS rows found in inventory")
        sys.exit(2)

    if vulnerable:
        print(f"VULNERABLE - {len(vulnerable)} device(s) with Chrome for iOS below 149.0.7827.53")
        for device, version in vulnerable[:25]:
            print(f"  {device}: {version}")
        if len(vulnerable) > 25:
            print(f"  ... and {len(vulnerable) - 25} more")
        if unknown:
            print(f"  NOTE: {len(unknown)} matching device(s) had unknown version data")
        sys.exit(1)

    if patched and not unknown:
        print(f"PATCHED - {len(patched)} Chrome for iOS device(s) are at or above 149.0.7827.53")
        sys.exit(0)

    print(
        f"UNKNOWN - no vulnerable versions found, but {len(unknown)} matching device(s) have missing/invalid version data"
    )
    for device, version in unknown[:25]:
        print(f"  {device}: {version}")
    sys.exit(2)


if __name__ == "__main__":
    main()