Inappropriate implementation in LiveCaption in Google Chrome prior to 149

#!/usr/bin/env python3
# check_cve_2026_11301.py
# Detect whether local Google Chrome is vulnerable to CVE-2026-11301
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import platform
import subprocess

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
        return out.strip()
    except Exception:
        return None


def check_explicit_path(path):
    if not path or not os.path.exists(path):
        return None
    out = run_cmd([path, '--version'])
    if out:
        v = parse_version(out)
        if v:
            return ('explicit-path', v)
    return None


def check_windows():
    try:
        import winreg
    except Exception:
        winreg = None

    if winreg:
        keys = [
            (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'Software\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'Software\WOW6432Node\Google\Chrome\BLBeacon'),
        ]
        for hive, path in keys:
            try:
                with winreg.OpenKey(hive, path) as k:
                    version, _ = winreg.QueryValueEx(k, 'version')
                    v = parse_version(version)
                    if v:
                        return ('registry', v)
            except Exception:
                pass

    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for p in candidates:
        if p and os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out or '')
            if v:
                return ('binary', v)
    return None


def check_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for p in candidates:
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out or '')
            if v:
                return ('binary', v)
    plist_candidates = [
        '/Applications/Google Chrome.app/Contents/Info.plist',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/Info.plist'),
    ]
    for p in plist_candidates:
        if os.path.exists(p):
            out = run_cmd(['/usr/bin/defaults', 'read', p.replace('/Contents/Info.plist', ''), 'CFBundleShortVersionString'])
            v = parse_version(out or '')
            if v:
                return ('plist', v)
    return None


def check_linux():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
        ['/usr/bin/google-chrome', '--version'],
        ['/usr/bin/google-chrome-stable', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = parse_version(out or '')
        if v:
            return ('command', v)
    return None


def main():
    explicit = None
    if len(sys.argv) >= 3 and sys.argv[1] == '--path':
        explicit = sys.argv[2]
        result = check_explicit_path(explicit)
        if not result:
            print('UNKNOWN - Could not read version from explicit path: {}'.format(explicit))
            sys.exit(2)
    else:
        result = None

    if not result:
        system = platform.system().lower()
        if 'windows' in system:
            result = check_windows()
        elif 'darwin' in system:
            result = check_macos()
        elif 'linux' in system:
            result = check_linux()
        else:
            print('UNKNOWN - Unsupported platform: {}'.format(platform.system()))
            sys.exit(2)

    if not result:
        print('UNKNOWN - Google Chrome not found or version unreadable')
        sys.exit(2)

    source, version = result
    fixed_str = version_to_str(FIXED)
    found_str = version_to_str(version)

    if cmp_ver(version, FIXED) < 0:
        print('VULNERABLE - Chrome version {} detected via {}; fixed version is {} or later'.format(found_str, source, fixed_str))
        sys.exit(1)
    else:
        print('PATCHED - Chrome version {} detected via {}; fixed version threshold is {}'.format(found_str, source, fixed_str))
        sys.exit(0)


if __name__ == '__main__':
    main()