Inappropriate implementation in Permissions in Google Chrome prior to 149

#!/usr/bin/env python3
# chrome_cve_2026_11300_check.py
# Checks local Chrome/Chromium version against the fixed build for CVE-2026-11300.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import argparse
import platform
import subprocess
from shutil import which

FIXED_DEFAULT = '149.0.7827.53'


def parse_version(v):
    m = re.findall(r'\d+', v or '')
    if not m:
        return None
    return tuple(int(x) for x in m)


def cmp_versions(a, b):
    la, lb = len(a), len(b)
    n = max(la, lb)
    a = a + (0,) * (n - la)
    b = b + (0,) * (n - lb)
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        pass
    return ''


def candidate_paths():
    system = platform.system().lower()
    paths = []
    if system == 'windows':
        envs = [os.environ.get('PROGRAMFILES'), os.environ.get('PROGRAMFILES(X86)'), os.environ.get('LOCALAPPDATA')]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for s in suffixes:
                    paths.append(os.path.join(base, s))
    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium'
        ])
    else:
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ])
    return paths


def windows_registry_version():
    reg_queries = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"]
    ]
    for cmd in reg_queries:
        out = run_cmd(cmd)
        m = re.search(r'version\s+REG_\w+\s+([0-9\.]+)', out, re.I)
        if m:
            return ('Google Chrome (registry)', m.group(1))
    return None


def discover_version():
    system = platform.system().lower()

    if system == 'windows':
        reg = windows_registry_version()
        if reg:
            return reg

    # Try binaries in PATH first
    for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        p = which(name)
        if p:
            out = run_cmd([p, '--version'])
            m = re.search(r'((Google Chrome|Chromium)\s+)?([0-9]+(?:\.[0-9]+){1,})', out)
            if m:
                product = 'Google Chrome' if 'Google Chrome' in out else 'Chromium'
                return (f'{product} ({p})', m.group(3))

    # Then try standard install paths
    for p in candidate_paths():
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            m = re.search(r'((Google Chrome|Chromium)\s+)?([0-9]+(?:\.[0-9]+){1,})', out)
            if m:
                product = 'Google Chrome' if 'Google Chrome' in out else 'Chromium'
                return (f'{product} ({p})', m.group(3))

    return None


def main():
    parser = argparse.ArgumentParser(description='Check for CVE-2026-11300 fixed Chrome version')
    parser.add_argument('--fixed', default=FIXED_DEFAULT, help='Fixed version threshold (default: 149.0.7827.53)')
    args = parser.parse_args()

    fixed = parse_version(args.fixed)
    if not fixed:
        print('UNKNOWN - invalid --fixed version supplied')
        sys.exit(2)

    found = discover_version()
    if not found:
        print('UNKNOWN - Chrome/Chromium not found')
        sys.exit(2)

    product, version_str = found
    current = parse_version(version_str)
    if not current:
        print(f'UNKNOWN - could not parse version from {product}: {version_str}')
        sys.exit(2)

    if cmp_versions(current, fixed) < 0:
        print(f'VULNERABLE - {product} version {version_str} is below fixed {args.fixed}')
        sys.exit(1)
    else:
        print(f'PATCHED - {product} version {version_str} meets/exceeds fixed {args.fixed}')
        sys.exit(0)


if __name__ == '__main__':
    main()