Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149

#!/usr/bin/env python3
"""
check_cve_2026_11302.py

Purpose:
  Assess MDM/UEM inventory for CVE-2026-11302 exposure in Chrome for iOS.

Usage:
  python3 check_cve_2026_11302.py inventory.csv
  python3 check_cve_2026_11302.py inventory.csv --app "Google Chrome"

Expected CSV:
  Any CSV with columns resembling device name, app name, and app version.
  Common examples:
    DeviceName,AppName,AppVersion
    device,application,version
    Name,ManagedApp,ShortVersion

Exit codes:
  0 = PATCHED (no vulnerable rows found, and no critical parsing ambiguity)
  1 = VULNERABLE (one or more vulnerable rows found)
  2 = UNKNOWN (could not confidently assess)
"""

import argparse
import csv
import re
import sys
from typing import Optional, Tuple

FIXED_VERSION = (149, 0, 7827, 53)
DEFAULT_APP_MATCH = "chrome"


def norm(s: str) -> str:
    return re.sub(r'[^a-z0-9]+', '', (s or '').strip().lower())


def parse_version(v: str) -> Optional[Tuple[int, ...]]:
    if not v:
        return None
    m = re.findall(r'\d+', v)
    if not m:
        return None
    try:
        return tuple(int(x) for x in m)
    except ValueError:
        return None


def cmp_version(a: Tuple[int, ...], b: Tuple[int, ...]) -> int:
    max_len = max(len(a), len(b))
    a2 = a + (0,) * (max_len - len(a))
    b2 = b + (0,) * (max_len - len(b))
    if a2 < b2:
        return -1
    if a2 > b2:
        return 1
    return 0


def pick_column(fieldnames, candidates):
    if not fieldnames:
        return None
    normalized = {norm(f): f for f in fieldnames}
    for c in candidates:
        if norm(c) in normalized:
            return normalized[norm(c)]
    for f in fieldnames:
        nf = norm(f)
        for c in candidates:
            if norm(c) in nf or nf in norm(c):
                return f
    return None


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('csv_file', help='Path to MDM/UEM inventory CSV')
    ap.add_argument('--app', default='Google Chrome', help='App name to match (default: Google Chrome)')
    args = ap.parse_args()

    try:
        with open(args.csv_file, 'r', encoding='utf-8-sig', newline='') as fh:
            reader = csv.DictReader(fh)
            fieldnames = reader.fieldnames
            if not fieldnames:
                print('UNKNOWN - CSV has no header row')
                sys.exit(2)

            device_col = pick_column(fieldnames, ['DeviceName', 'Device', 'Name', 'Hostname', 'SerialNumber', 'UDID'])
            app_col = pick_column(fieldnames, ['AppName', 'Application', 'ManagedApp', 'App', 'Name'])
            ver_col = pick_column(fieldnames, ['AppVersion', 'Version', 'ShortVersion', 'ApplicationVersion'])
            os_col = pick_column(fieldnames, ['OS', 'Platform', 'OperatingSystem'])

            if not app_col or not ver_col:
                print(f'UNKNOWN - unable to find app/version columns in headers: {fieldnames}')
                sys.exit(2)

            wanted = norm(args.app)
            vulnerable = []
            unknown = []
            assessed = 0

            for idx, row in enumerate(reader, start=2):
                app_name = (row.get(app_col) or '').strip()
                app_norm = norm(app_name)
                if wanted not in app_norm and DEFAULT_APP_MATCH not in app_norm:
                    continue

                # Optional platform sanity check if present
                if os_col:
                    os_val = (row.get(os_col) or '').lower()
                    if os_val and 'ios' not in os_val and 'ipad' not in os_val:
                        continue

                assessed += 1
                device_name = (row.get(device_col) or f'row:{idx}').strip()
                ver_raw = (row.get(ver_col) or '').strip()
                ver = parse_version(ver_raw)
                if ver is None:
                    unknown.append((device_name, app_name, ver_raw, 'unparseable version'))
                    continue

                if cmp_version(ver, FIXED_VERSION) < 0:
                    vulnerable.append((device_name, app_name, ver_raw))

            if assessed == 0:
                print('UNKNOWN - no matching Chrome for iOS rows found in CSV')
                sys.exit(2)

            if vulnerable:
                print('VULNERABLE')
                print(f'Found {len(vulnerable)} vulnerable installation(s) of Chrome for iOS < 149.0.7827.53:')
                for dev, app, ver in vulnerable:
                    print(f' - {dev}: {app} {ver}')
                if unknown:
                    print(f'Also found {len(unknown)} matching row(s) with unknown version parsing.')
                sys.exit(1)

            if unknown:
                print('UNKNOWN')
                print('No confirmed vulnerable installs found, but some matching rows could not be parsed:')
                for dev, app, ver, reason in unknown:
                    print(f' - {dev}: {app} {ver!r} ({reason})')
                sys.exit(2)

            print('PATCHED')
            print('All matching Chrome for iOS rows are at or above 149.0.7827.53')
            sys.exit(0)

    except FileNotFoundError:
        print(f'UNKNOWN - file not found: {args.csv_file}')
        sys.exit(2)
    except Exception as e:
        print(f'UNKNOWN - unexpected error: {e}')
        sys.exit(2)


if __name__ == '__main__':
    main()