Skip to main content

Google Chrome Update Damages macOS File System

(Image credit: Shutterstock)

Variety reported yesterday that Mac systems throughout Hollywood stopped working on Monday night. The affected users originally blamed video editing software, but in a twist even M. Night Shyamalan would find implausible, the issue was actually caused by Google Chrome.

Google said in a forum post that "a Chrome update may have shipped with a bug that damages the file system on macOS machines with System Integrity Protection (SIP) disabled." Devices that don't support SIP, which debuted with OS X El Capitan in 2015, were also affected.

Apple explained in a support article that SIP is "designed to help prevent potentially malicious software from modifying protected files and folders on your Mac" by limiting "the actions that the root user can perform on protected parts of the Mac operating system."

The good news is that SIP is automatically enabled on all devices running OS X 10.9 or later. (That includes macOS releases, too, because Apple merely rebranded the operating system.) Someone would have to intentionally disable it to risk being affected by the Chrome update.

But it seems like the video editors in Tinseltown--and presumably other people whose tech support problems aren't reported in Variety--were susceptible regardless. Google said affected devices can be restored by booting into recovery mode and entering this into Terminal:

chroot /Volumes/Macintosh\ HD # "Macintosh HD" is the defaultrm -rf /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundlemv var var_back # var may not exist, but this is fineln -sh private/var varchflags -h restricted /varchflags -h hidden /varxattr -sw com.apple.rootless "" /var

The company said that will "remove the affected version of Google Software Update, then restore the damaged portion of the file system." It's withdrawn the update in the meantime and is working on a version of Chrome that won't disrupt Macs without SIP enabled.

  • xerhino
    I don't know if you can modify the text box that contains terminal commands, but the rm -rf statement got split onto it's own line by the formatting and it's really important that people know it belongs with the GoogleSoftwareUpdate.bundle path.
    Reply
  • bit_user
    The title is odd, to me. I suppose if Google phrased it that way, then sure. However, what "filesystem damage" looks like to me: it's the very "on-disk datastructures that are used to organize the data on disk" becoming corrupted. This would manifest in things like garbled filenames, files with strange names, missing files & directories and others being potentially relocated. In other words, it wouldn't be limited to a specific subtree.
    Reply