R C-R wrote:
BTW, where these apps live is no mystery -- they are easy enough to find with Finder searches or with the System Information app in the Applications section. The app itself can be found in ~/Applications/Chrome Apps (the user, not system domain Applications folder).
Anyway, as apps go, from what I can tell at least the the YouTube app is very lightweight & does very little -- it just launches Chrome if it isn't already running, accesses https://www.youtube.com/ & terminates. It even has its own very ordinary looking Applescript dictionary.
As for changing any system or user level defaults, I can't see any indication that happens either.
No, these apps are pretty funky. Google is a respected company with a well-known advertising-driven business model. Most people know that and either don't care, avoid it, or try hard to get value from Google while handing over as little as possible. In spite of internet meme, Google really isn't "evil". But, Google is very creative in terms of both social and technical engineering. The danger here is that real evil people will see what Google does and use those sneaky tricks for truly nefarious things.
These apps are a good example. They don't actually exist anywhere in Google Chrome. This is an application that, at some point after you first launch it, decides to start creating new apps. Yeah, maybe they are in the user domain, but those look the same in LaunchPad. A malicious app could create a new Safari, Mail, Twitter, or Word. Then it could ask for your password. The user thinks, I just launched Mail, must be another funky Apple bug, here's the password. Then the fake Mail launches the real Mail. The user never knows what just happened.
The user defaults are interesting too. I checked those when I tried to reinstall Google Chrome to get these apps re-created. I deleted all the Google preferences I could find, but I couldn't get it back to the original state. Granted, I didn't do a thorough forensic analysis or anything. But Google is really not being straightforward. Chrome does different things in different contexts. I first tried this on my burner machine where I had already run Chrome, but without actually "installing" it inside /Applications. I had just run it from the disk image. When I install Chrome in a VM, I actually get 4 different Chrome apps installed into the user Applications folder and LaunchPad. I'm not complaining about that. I'm just wondering why I didn't get all 4 the first time I tried.
Plus, the connection between chrome://apps and that user Applications directory is interesting. They are connected, but not completely. I can delete things from Chrome and they go away in ~/Applications and LaunchPad. I can delete things from ~/Applications and they go away in LaunchPad, but not Chrome. It seems pretty clear that Google's intent is to create its own Google Play web app ecosystem and have those apps colonize your Mac desktop. But this is Google and that is the kind of schtick they do. But I'm sure other people are going to get some ideas. I can envision some free and useful apps that, at random times, create new apps that perform malicious activities. Every day could be a brand-new zero-day.