Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart.
With the macOS bug we described in https://mysk.blog/2026/07/23/macos-overwrite-app-executables/, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy)
https://youtu.be/lLJkxWR71B0
*This is also a good reminder to uninstall Chrome 😎
Mysk🇨🇦🇩🇪
npub1h5…5hfst
2026-07-24 12:02:07 UTC
Author Public Key
npub1h5s3huxjkajkqnqxtvppuwe59x8jzdkqqskdkejmd0mzs2ex383sl5hfstSeen on
wss://relay.momostr.pinkPublished at
2026-07-24 12:02:07 UTCEvent JSON
{
"id": "aab14658322ae4462d6823f1a2aa7f52699ce3526b29dc5473e386ba5024c6ee",
"pubkey": "bd211bf0d2b765604c065b021e3b34298f2136c0042cdb665b6bf6282b2689e3",
"created_at": 1784894527,
"kind": 1,
"tags": [
[
"proxy",
"https://mastodon.social/@mysk/116974847786124516",
"web"
],
[
"proxy",
"https://mastodon.social/users/mysk/statuses/116974847786124516",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.social/users/mysk/statuses/116974847786124516",
"pink.momostr"
],
[
"-"
]
],
"content": "Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart.\nWith the macOS bug we described in https://mysk.blog/2026/07/23/macos-overwrite-app-executables/, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy)\n\nhttps://youtu.be/lLJkxWR71B0\n\n*This is also a good reminder to uninstall Chrome 😎",
"sig": "14330945a8990240b5479d33b4e242ce0952786609e80b03fedf8be8a630216308d79a6d8c91d15849f2749f844105b0f71b29ff19ad82ed282afe33dd57717a"
}