Google Chrome PDFium use-after-free via crafted PDF

#!/usr/bin/env python3
# Check local Google Chrome version for CVE-2026-11304 exposure
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_windows():
    candidates = [
        [r'C:\Program Files\Google\Chrome\Application\chrome.exe', '--version'],
        [r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe', '--version'],
    ]
    local_appdata = os.environ.get('LOCALAPPDATA')
    if local_appdata:
        candidates.append([os.path.join(local_appdata, 'Google', 'Chrome', 'Application', 'chrome.exe'), '--version'])

    for cmd in candidates:
        if os.path.exists(cmd[0]):
            out = run_cmd(cmd)
            v = parse_version(out)
            if v:
                return v, cmd[0]

    ps = which('powershell') or which('pwsh')
    if ps:
        script = r"""
$paths = @(
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
  'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
)
foreach ($p in $paths) {
  try {
    $item = Get-ItemProperty -Path $p -ErrorAction Stop
    if ($item.'(default)') { Write-Output $item.'(default)'; break }
  } catch {}
}
"""
        out = run_cmd([ps, '-NoProfile', '-Command', script])
        exe = out.strip().splitlines()[0] if out.strip() else ''
        if exe and os.path.exists(exe):
            ver = parse_version(run_cmd([exe, '--version']))
            if ver:
                return ver, exe

    return None, None


def detect_macos():
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for p in paths:
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out)
            if v:
                return v, p
    return None, None


def detect_linux():
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    for name in names:
        exe = which(name)
        if exe:
            out = run_cmd([exe, '--version'])
            v = parse_version(out)
            if v:
                return v, exe

    extra_paths = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
    ]
    for p in extra_paths:
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out)
            if v:
                return v, p

    return None, None


def compare_versions(found, fixed):
    if found < fixed:
        return -1
    if found > fixed:
        return 1
    return 0


def main():
    system = platform.system().lower()
    if 'windows' in system:
        version, source = detect_windows()
    elif 'darwin' in system:
        version, source = detect_macos()
    else:
        version, source = detect_linux()

    if not version:
        print('UNKNOWN: could not determine local Chrome/Chromium version')
        sys.exit(2)

    print(f'DETECTED: {source} -> {".".join(map(str, version))}')
    cmp = compare_versions(version, FIXED)
    if cmp < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()