Out of bounds read and write in V8 in Google Chrome prior to 147

#!/usr/bin/env python3
# check_cve_2026_5873.py
# Determine whether locally installed Chrome/Chromium/Edge builds are vulnerable to CVE-2026-5873.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

TARGET_CHROME = (147, 0, 7727, 55)
TARGET_EDGE = (147, 0, 3912, 60)  # Chromium fixes incorporated by Edge release notes


def parse_version(s: str) -> Optional[Tuple[int, ...]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_ge(found: Tuple[int, ...], target: Tuple[int, ...]) -> bool:
    max_len = max(len(found), len(target))
    f = found + (0,) * (max_len - len(found))
    t = target + (0,) * (max_len - len(target))
    return f >= t


def run_version(cmd: List[str]) -> Optional[str]:
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=5)
        return out.strip()
    except Exception:
        return None


def windows_candidates() -> List[Tuple[str, List[str]]]:
    pf = os.environ.get('ProgramFiles', r'C:\Program Files')
    pfx86 = os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)')
    local = os.environ.get('LOCALAPPDATA', '')
    return [
        ('chrome', [os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe')]),
        ('chrome', [os.path.join(pfx86, 'Google', 'Chrome', 'Application', 'chrome.exe')]),
        ('chrome', [os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe')]),
        ('edge', [os.path.join(pf, 'Microsoft', 'Edge', 'Application', 'msedge.exe')]),
        ('edge', [os.path.join(pfx86, 'Microsoft', 'Edge', 'Application', 'msedge.exe')]),
        ('chromium', [os.path.join(pf, 'Chromium', 'Application', 'chrome.exe')]),
        ('chromium', [os.path.join(pfx86, 'Chromium', 'Application', 'chrome.exe')]),
    ]


def mac_candidates() -> List[Tuple[str, List[str]]]:
    return [
        ('chrome', ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', '--version']),
        ('edge', ['/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge', '--version']),
        ('chromium', ['/Applications/Chromium.app/Contents/MacOS/Chromium', '--version']),
    ]


def linux_candidates() -> List[Tuple[str, List[str]]]:
    cmds = []
    for name, kind in [
        ('google-chrome', 'chrome'),
        ('google-chrome-stable', 'chrome'),
        ('chromium', 'chromium'),
        ('chromium-browser', 'chromium'),
        ('microsoft-edge', 'edge'),
        ('microsoft-edge-stable', 'edge'),
    ]:
        path = shutil.which(name)
        if path:
            cmds.append((kind, [path, '--version']))
    return cmds


def collect_candidates() -> List[Tuple[str, List[str]]]:
    system = platform.system().lower()
    if system == 'windows':
        out = []
        for kind, parts in windows_candidates():
            exe = parts[0]
            if os.path.exists(exe):
                out.append((kind, [exe, '--version']))
        return out
    if system == 'darwin':
        return [(k, c) for k, c in mac_candidates() if os.path.exists(c[0])]
    return linux_candidates()


def assess(kind: str, ver: Tuple[int, ...]) -> str:
    if kind in ('chrome', 'chromium'):
        return 'PATCHED' if version_ge(ver, TARGET_CHROME) else 'VULNERABLE'
    if kind == 'edge':
        return 'PATCHED' if version_ge(ver, TARGET_EDGE) else 'VULNERABLE'
    return 'UNKNOWN'


def main() -> int:
    candidates = collect_candidates()
    if not candidates:
        print('UNKNOWN - no supported Chrome/Chromium/Edge installation found in common paths')
        return 2

    results = []
    for kind, cmd in candidates:
        raw = run_version(cmd)
        if not raw:
            continue
        ver = parse_version(raw)
        if not ver:
            results.append((kind, raw, 'UNKNOWN'))
            continue
        status = assess(kind, ver)
        results.append((kind, '.'.join(map(str, ver)), status))

    if not results:
        print('UNKNOWN - browser found but version could not be read')
        return 2

    for kind, ver, status in results:
        print(f'{kind.upper()} {ver} => {status}')

    if any(status == 'VULNERABLE' for _, _, status in results):
        print('VULNERABLE')
        return 1
    if all(status == 'PATCHED' for _, _, status in results):
        print('PATCHED')
        return 0

    print('UNKNOWN')
    return 2


if __name__ == '__main__':
    sys.exit(main())