Google Chrome DOM use-after-free allows sandboxed renderer code execution

#!/usr/bin/env python3
# check_chrome_cve_2026_9126.py
# Detect local Chrome/Chromium version exposure for CVE-2026-9126.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

APP_NAMES = [
    "Google Chrome",
    "Google Chrome for Testing",
    "Chromium",
    "chrome",
    "chromium",
]


def parse_version(text):
    if not text:
        return None
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return ".".join(str(x) for x in v) if v else "UNKNOWN"


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or "") + "\n" + (p.stderr or "")
        return out.strip()
    except Exception:
        return ""


def detect_windows():
    candidates = []
    local = os.environ.get("LOCALAPPDATA", "")
    pf = os.environ.get("ProgramFiles", "")
    pf86 = os.environ.get("ProgramFiles(x86)", "")
    paths = [
        os.path.join(local, "Google", "Chrome", "Application", "chrome.exe"),
        os.path.join(pf, "Google", "Chrome", "Application", "chrome.exe"),
        os.path.join(pf86, "Google", "Chrome", "Application", "chrome.exe"),
        os.path.join(local, "Chromium", "Application", "chrome.exe"),
    ]

    try:
        import winreg
        reg_paths = [
            (winreg.HKEY_CURRENT_USER, r"Software\Google\Chrome\BLBeacon"),
            (winreg.HKEY_LOCAL_MACHINE, r"Software\Google\Chrome\BLBeacon"),
            (winreg.HKEY_LOCAL_MACHINE, r"Software\WOW6432Node\Google\Chrome\BLBeacon"),
            (winreg.HKEY_CURRENT_USER, r"Software\Chromium\BLBeacon"),
            (winreg.HKEY_LOCAL_MACHINE, r"Software\Chromium\BLBeacon"),
        ]
        for hive, keypath in reg_paths:
            try:
                key = winreg.OpenKey(hive, keypath)
                version, _ = winreg.QueryValueEx(key, "version")
                if version:
                    candidates.append(("registry", version))
            except OSError:
                pass
    except Exception:
        pass

    for p in paths:
        if os.path.exists(p):
            out = run_cmd([p, "--version"])
            if out:
                candidates.append((p, out))

    return candidates


def detect_macos():
    candidates = []
    apps = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
        "/Applications/Chromium.app/Contents/MacOS/Chromium",
    ]
    for p in apps:
        if os.path.exists(p):
            out = run_cmd([p, "--version"])
            if out:
                candidates.append((p, out))
    return candidates


def detect_linux():
    candidates = []
    cmds = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium", "--version"],
        ["chromium-browser", "--version"],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        if out:
            candidates.append((" ".join(cmd), out))

    # Debian dpkg fallback
    out = run_cmd(["dpkg-query", "-W", "-f=${Version}", "chromium"])
    if out:
        candidates.append(("dpkg chromium", out))
    return candidates


def main():
    system = platform.system().lower()
    fixed_default = (148, 0, 7778, 179)
    fixed_linux = (148, 0, 7778, 178)

    if "windows" in system:
        fixed = fixed_default
        candidates = detect_windows()
    elif "darwin" in system:
        fixed = fixed_default
        candidates = detect_macos()
    elif "linux" in system:
        fixed = fixed_linux
        candidates = detect_linux()
    else:
        print("UNKNOWN - unsupported platform: {}".format(platform.system()))
        sys.exit(2)

    if not candidates:
        print("UNKNOWN - Chrome/Chromium not found")
        sys.exit(2)

    found_versions = []
    for source, raw in candidates:
        v = parse_version(raw)
        if v:
            found_versions.append((source, raw, v))

    if not found_versions:
        print("UNKNOWN - version could not be parsed from detected installations")
        sys.exit(2)

    # Use the lowest detected version to be conservative.
    lowest = min(found_versions, key=lambda x: x[2])
    source, raw, ver = lowest

    if cmp_ver(ver, fixed) < 0:
        print("VULNERABLE - detected {} from {} ; fixed threshold is {}".format(version_to_str(ver), source, version_to_str(fixed)))
        sys.exit(1)
    else:
        print("PATCHED - detected {} from {} ; fixed threshold is {}".format(version_to_str(ver), source, version_to_str(fixed)))
        sys.exit(0)


if __name__ == "__main__":
    main()