Google Chrome WebRTC heap buffer overflow with sandboxed renderer code execution

#!/usr/bin/env python3
# check_cve_2026_9119.py
# Determine whether a local Chrome/Chromium binary is vulnerable to CVE-2026-9119.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')

FIXED_WINDOWS_MAC = (148, 0, 7778, 179)
FIXED_LINUX = (148, 0, 7778, 178)


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def candidates():
    system = platform.system().lower()
    c = []

    if len(sys.argv) > 1:
        c.append(sys.argv[1])

    # PATH-based binaries
    for name in [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser',
        'chrome', 'msedge'  # included only so the script can tell you UNKNOWN/not-applicable if pointed there
    ]:
        p = shutil.which(name)
        if p:
            c.append(p)

    if system == 'windows':
        envs = [
            os.environ.get('PROGRAMFILES'),
            os.environ.get('PROGRAMFILES(X86)'),
            os.environ.get('LOCALAPPDATA')
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for s in suffixes:
                    c.append(os.path.join(base, s))
    elif system == 'darwin':
        c.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium'
        ])
    else:
        c.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ])

    # de-dup while preserving order
    seen = set()
    out = []
    for item in c:
        if item and item not in seen:
            seen.add(item)
            out.append(item)
    return out


def get_version(binary):
    try:
        cp = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=10)
        text = (cp.stdout or '') + ' ' + (cp.stderr or '')
        return parse_version(text), text.strip()
    except Exception:
        return None, ''


def main():
    system = platform.system().lower()
    fixed = FIXED_LINUX if system == 'linux' else FIXED_WINDOWS_MAC

    found_any = False
    for binary in candidates():
        if not os.path.exists(binary):
            continue
        found_any = True
        ver, raw = get_version(binary)
        if ver is None:
            continue

        # Basic product sanity check
        lowered = raw.lower()
        if 'edge' in lowered:
            print(f'UNKNOWN: {binary} appears to be Microsoft Edge, not Chrome/Chromium ({raw})')
            sys.exit(2)

        status = 'PATCHED' if cmp_ver(ver, fixed) >= 0 else 'VULNERABLE'
        print(f'{status}: {binary} version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]}')
        sys.exit(0 if status == 'PATCHED' else 1)

    if not found_any:
        print('UNKNOWN: no Chrome/Chromium binary found; pass an explicit path as an argument')
    else:
        print('UNKNOWN: found candidate binary but could not parse a version')
    sys.exit(2)


if __name__ == '__main__':
    main()