Why does the Google Chrome app bundle become corrupted on macOS 15.5 with missing files in /Applications/Google Chrome.app?

I work for an MSP (Managed Service Provider). We're encountering a recurring issue across different clients running macOS 15.5 (Sequoia) systems where Google Chrome becomes corrupted or non-functional. After a successful installation, Chrome works normally for a time, but later becomes unlaunchable. Upon inspection, the .app bundle in /Applications is missing critical files, including the main binary under Contents/macOS. #### What We've Observed: - Chrome is installed from the official .dmg and initially works as expected. At some point later (often after a reboot or idle period), - Chrome fails to launch. The app bundle remains in /Applications, but key files are missing. Running spctl --assess reports the app as invalid or corrupted. - The com.apple.quarantine attribute is often absent from the bundle. - Reinstalling Chrome restores functionality, but the issue may recur. #### Additional Context: - One client reported the same thing happening to Microsoft Edge and I had seen community reports indicating Brave may also be affected. These are both Chromium-based browsers. - Vivaldi, also Chromium-based, appears unaffected. - No alerts or actions are logged by our endpoint protection or MDM tools (e.g., CrowdStrike, InTune). - We suspect macOS system security tools (e.g., MRT, Gatekeeper, or XProtect) may be silently removing or quarantining files from Chrome. #### What We've Tried: - Tested on clean macOS 15.5 systems (VM and personal MacBook Pro): Chrome installs and runs fine, no corruption observed. - Manually ran MRT using: sudo /Library/Apple/System/Library/CoreServices/MRT.app/Contents/MacOS/MRT -a It exits silently with no indication of action. - MRT logs show normal startup and shutdown behavior—no deletions or signature failures. Workaround: Installing Chrome to ~/Applications (user space) allows users to reinstall it without admin rights. This avoids the issue so far, but it's not a long-term solution. ### Questions 1. Has anyone else observed this behavior on macOS 15.5 with Chrome or other Chromium-based browsers? 2. Could MRT, Gatekeeper, or XProtect be responsible for removing files from a valid Chrome installation? 3. Are there logs or tools that can confirm if a system process is deleting these files? 4. Any suggestions for monitoring or preventing this behavior? ### New information from 7/17/2025: - First reported case of this issue on a machine *not* running macOS 15.5. The user was running 15.4.1. - I obtained the GoogleUpdater log from this computer and it has a gap over the period when the files were removed so I don't think Google Updater messed with those files on this machine. That still leaves the question of what did. - Etrecheck didn't show too much but it did show Chrome was unsigned. I'd expect this because the _CodeSignature directory in the app bundle is empty when this issue presents.