Google Chrome WebRTC use-after-free on Linux

#!/usr/bin/env bash
# check_cve_2026_9111.sh
# Detect likely exposure to CVE-2026-9111 on Linux Chrome/Chromium hosts.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

# Note: Public sources disagree on the Linux fixed version:
# - CVE/NVD text says prior to 148.0.7778.179 is vulnerable
# - Google Chrome Releases says Linux updated to 148.0.7778.178 on 2026-05-19
# We use the stricter threshold (.179) for Google Chrome binaries,
# and report distro Chromium package builds based on their package version strings.

STRICT_FIXED="148.0.7778.179"
VENDOR_LINUX_FIXED="148.0.7778.178"

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

extract_version() {
  # Pull first x.y.z.w-like token
  echo "$1" | grep -Eo '[0-9]+(\.[0-9]+){3,}' | head -n1
}

status="UNKNOWN"
reason="No supported Chrome/Chromium install found"
found_any=0

check_binary() {
  local bin="$1"
  local flavor="$2"
  local out ver

  if ! have_cmd "$bin"; then
    return
  fi

  found_any=1
  out="$($bin --version 2>/dev/null || true)"
  ver="$(extract_version "$out")"

  if [ -z "$ver" ]; then
    status="UNKNOWN"
    reason="Could not parse version from $bin"
    return
  fi

  case "$flavor" in
    google-chrome)
      if ver_lt "$ver" "$STRICT_FIXED"; then
        status="VULNERABLE"
        reason="$bin version $ver is below strict fixed threshold $STRICT_FIXED for CVE-2026-9111"
      else
        status="PATCHED"
        reason="$bin version $ver is at or above strict fixed threshold $STRICT_FIXED"
      fi
      ;;
    chromium)
      # Upstream Linux advisory/blog indicates 148.0.7778.178 for Linux.
      if ver_lt "$ver" "$VENDOR_LINUX_FIXED"; then
        status="VULNERABLE"
        reason="$bin version $ver is below Linux fixed threshold $VENDOR_LINUX_FIXED"
      else
        status="PATCHED"
        reason="$bin version $ver is at or above Linux fixed threshold $VENDOR_LINUX_FIXED"
      fi
      ;;
  esac
}

check_pkg() {
  # Best-effort package checks for distros where Chromium is package-managed.
  if have_cmd dpkg-query; then
    local pkgver
    pkgver="$(dpkg-query -W -f='${Version}\n' chromium 2>/dev/null | head -n1 || true)"
    if [ -n "$pkgver" ]; then
      found_any=1
      case "$pkgver" in
        148.0.7778.178-1~deb12u1|148.0.7778.178-1~deb13u1|148.0.7778.178-*|148.0.7778.179-*|149.*|150.*)
          status="PATCHED"
          reason="Debian/Ubuntu chromium package version $pkgver appears fixed/backported"
          return
          ;;
      esac
      # Fall back to numeric prefix if present
      local base
      base="$(echo "$pkgver" | grep -Eo '^[0-9]+(\.[0-9]+){3,}' | head -n1)"
      if [ -n "$base" ]; then
        if ver_lt "$base" "$VENDOR_LINUX_FIXED"; then
          status="VULNERABLE"
          reason="chromium package base version $base is below Linux fixed threshold $VENDOR_LINUX_FIXED"
        else
          status="PATCHED"
          reason="chromium package base version $base is at or above Linux fixed threshold $VENDOR_LINUX_FIXED"
        fi
        return
      fi
      status="UNKNOWN"
      reason="Found chromium package $pkgver but could not map it confidently to fixed/backported status"
    fi
  fi

  if have_cmd rpm; then
    local rpmver
    rpmver="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' chromium 2>/dev/null | head -n1 || true)"
    if [ -n "$rpmver" ] && [ "$rpmver" != "package chromium is not installed" ]; then
      found_any=1
      case "$rpmver" in
        148.0.7778.178-*|148.0.7778.179-*|149.*|150.*)
          status="PATCHED"
          reason="RPM chromium package version $rpmver appears fixed/backported"
          return
          ;;
      esac
      local base
      base="$(echo "$rpmver" | grep -Eo '^[0-9]+(\.[0-9]+){3,}' | head -n1)"
      if [ -n "$base" ]; then
        if ver_lt "$base" "$VENDOR_LINUX_FIXED"; then
          status="VULNERABLE"
          reason="RPM chromium base version $base is below Linux fixed threshold $VENDOR_LINUX_FIXED"
        else
          status="PATCHED"
          reason="RPM chromium base version $base is at or above Linux fixed threshold $VENDOR_LINUX_FIXED"
        fi
        return
      fi
      status="UNKNOWN"
      reason="Found RPM chromium package $rpmver but could not map it confidently to fixed/backported status"
    fi
  fi
}

# Prefer explicit browser binaries first.
check_binary google-chrome google-chrome
if [ "$status" = "UNKNOWN" ]; then check_binary google-chrome-stable google-chrome; fi
if [ "$status" = "UNKNOWN" ]; then check_binary chromium chromium; fi
if [ "$status" = "UNKNOWN" ]; then check_binary chromium-browser chromium; fi
if [ "$status" = "UNKNOWN" ]; then check_pkg; fi

if [ "$found_any" -eq 0 ]; then
  echo "UNKNOWN: $reason"
  exit 2
fi

case "$status" in
  PATCHED)
    echo "PATCHED: $reason"
    exit 0
    ;;
  VULNERABLE)
    echo "VULNERABLE: $reason"
    exit 1
    ;;
  *)
    echo "UNKNOWN: $reason"
    exit 2
    ;;
esac