Mathspace Security Get help

FOR MAC · CVE-2026-106378

Remove vulnerable
Chrome copies.

Check the Chrome copies saved by automation tools.
Review the results. Then choose to remove them.

Get started

Runs on your Mac. Nothing is removed without confirmation.

What this is for

CVE-2026-106378 is a Chrome sandbox issue specific to macOS, fixed in Chrome 155.0.8059.39. Automation tools can keep older Chrome copies even after your everyday browser updates.

This tool checks the default Playwright, Puppeteer, Selenium and Pyppeteer browser caches in your user account. It offers to stop and delete older copies and copies whose version can’t be read.

For Mac only. Custom cache locations and project-local copies aren’t checked.

STEP BY STEP

Let’s walk through it.

You don’t need to install anything or be an administrator.

  1. Download the cleanup tool.

    Save the file in your Downloads folder. Keep its name as chrome-cleanup-macos.sh.

    Download for Mac

    A small script file. The download doesn’t run it.

  2. Open Terminal.

    Press ⌘ Command + Space to open Spotlight.
    Type Terminal, then press Return.

    Terminal is already included on your Mac.

  3. Paste one command.

    Copy the command below. Click in Terminal, press ⌘ V to paste, then press Return.

    bash "$HOME/Downloads/chrome-cleanup-macos.sh"

    This checks the cached browser copies and shows you the results.

  4. Review. Then choose.

    The tool lists each browser copy and whether it will be kept or deleted. Older and unknown versions are marked for deletion.

    Ready to remove them?

    Type delete and press Return.
    To cancel, just press Return.

    Confirming stops the selected browsers and their helpers, then permanently removes those cached copies.

Before using automation again.

Update your automation tools and reinstall their browsers. Jobs may fail until you do, and older tool versions can download vulnerable browsers again. If you’re unsure how, ask in #security-discuss on Slack.

A few useful details.

Will this remove my everyday Chrome browser?

It only targets browser copies in the four default automation caches. It doesn’t remove the Chrome app in Applications or its normal browsing profile.

What if it says no copies were found?

There’s nothing to delete in the locations it checked. This isn’t a complete security check: browsers stored in custom or project-local locations aren’t included.

What if the command doesn’t work?

Check that the file is in Downloads and is named chrome-cleanup-macos.sh. If Safari added .txt to the name, rename it to end in .sh. If it still doesn’t work, post the message in #security-discuss on Slack. You don’t need to run the command as an administrator.

Does removing these copies resolve an existing compromise?

No. It removes the selected cached browsers. If you suspect the Mac has already been compromised, ask for help in #security-discuss on Slack.

HERE TO HELP

A question along the way?

Post in #security-discuss on Slack.
Include what you see in Terminal so we can help.

#security-discuss