Chrome code_sign_clone is huge.
What it is and how to remove it safely.

What the code_sign_clone folder is

When Chrome updates itself, the copy of the app that is running must keep working until you relaunch it. To make that possible, a copy of the signed application bundle is kept in a private temporary folder that belongs to your user account. The folder name ends in .code_sign_clone and starts with the app's bundle identifier, so Chrome's is com.google.Chrome.code_sign_clone. Chromium-based browsers can create their own, for example org.chromium.Chromium.code_sign_clone, and Chrome Canary uses com.google.Chrome.canary.code_sign_clone.

Each clone holds a complete copy of the browser, which is roughly the size of the app itself. A single copy is not a problem. The trouble starts when copies from earlier updates are not cleaned up. On a Mac that has run Chrome for a year or two, it is common to find several gigabytes here, and we have measured more than 25 GB on a developer's Mac with one browser and a handful of profiles.

Because the folder lives outside your home folder's visible locations, Finder does not show it, Spotlight does not index it, and the Storage settings count it as System Data. That is why a large Chrome clone often shows up as an unexplained jump in System Data rather than as a large file you can find.

Find it and measure it

Your account's temporary area has a random-looking path under /private/var/folders. Rather than guessing it, ask macOS. The temporary folder ends in T; the clones live in its sibling folder named X.

1. Open Terminal (Applications → Utilities → Terminal).
2. Run the read-only command below. It prints the size of every code-sign clone in your account and changes nothing.
3. If nothing is printed, you have no clones and this guide does not apply to your Mac.

du -sh "$(dirname "$(getconf DARWIN_USER_TEMP_DIR)")"/X/*.code_sign_clone 2>/dev/null

To look at the folder in Finder instead, run the next command. It opens the X folder in a Finder window so you can see the clones and their sizes with View → Show View Options → Calculate all sizes in list view.

open "$(dirname "$(getconf DARWIN_USER_TEMP_DIR)")/X"

Leave everything else in that folder alone. The X, T and C folders are working areas for many apps and for macOS itself. Only folders whose names end in .code_sign_clone are covered by this guide.

Is it safe to delete?

Yes, with one condition: the browser it belongs to must not be running. While Chrome is open, it may be using the clone, and removing it underneath the browser can make the current session misbehave until you relaunch. Once Chrome has quit, the clone is not needed. Chrome makes a new one the next time an update requires it.

Deleting the clone does not touch your bookmarks, passwords, history, extensions or open tabs. Those live in your Chrome profile under ~/Library/Application Support/Google/Chrome, which is a different place entirely. The clone is only a copy of the application program.

Remove it step by step

1. Quit Chrome completely. Choose Chrome → Quit Google Chrome, or press ⌘Q. Closing the windows is not enough; the app keeps running in the background. Check the Dock: there should be no dot under the Chrome icon. If you use other Chromium browsers, quit them too.
2. Open the X folder with the open command above.
3. Select only the clone folders whose names end in .code_sign_clone and belong to browsers you have quit.
4. Move them to the Trash (⌘Delete). You may be asked for your password because the folder is protected; that is expected.
5. Open Chrome again and check that it starts normally. Then empty the Trash to get the space back.

If you prefer Terminal, the following command moves only Chrome's clone into your Trash, and only after checking that Chrome is not running. It does not delete anything permanently; you can drag the folder back out of the Trash until you empty it.

pgrep -xq "Google Chrome" && echo "Quit Chrome first" || \
  mv "$(dirname "$(getconf DARWIN_USER_TEMP_DIR)")/X/com.google.Chrome.code_sign_clone" ~/.Trash/

Why it comes back

The clone is part of how browser updates work, so it is normal for one to exist again after Chrome updates. What you are cleaning up is the backlog of old copies that were not removed. If the size climbs back to many gigabytes within weeks, check whether you run several Chromium-based browsers or Chrome channels (Stable, Beta, Canary), since each keeps its own clone. Restarting your Mac now and then also gives macOS a chance to clear its temporary areas.

Do not try to stop clones from being created by changing permissions on the folder or replacing it with a file. That can break browser updates, and an out-of-date browser is a far bigger problem than a temporary copy that takes up space.

How this shows up in Storage settings

Open System Settings → General → Storage. The clone is counted inside System Data, together with caches, logs, virtual memory and other files that do not have a category of their own. After you remove a large clone and empty the Trash, the System Data figure may take a little while to recalculate. Compare the available space at the top of the Storage pane, which updates sooner and is the number that matters.

If System Data is still large afterwards, the clone was only one contributor. The System Data guide walks through the other common ones, such as large app data folders, Time Machine local snapshots and iOS device support files.

Example: a 25 GB surprise

A developer's Mac reported 360 GB of System Data on a 500 GB disk. Storage settings offered no detail, and the largest folders in Documents and Applications added up to less than 90 GB. Measuring the code-sign clone area showed one Chrome clone of 25 GB and one Chromium clone of 4.8 GB, left behind by months of updates. With both browsers quit, moving the two folders to the Trash and emptying it returned about 30 GB of free space. Chrome opened normally, with every profile, tab and extension in place.

The same Mac had other large contributors as well, so System Data did not drop to a small number. That is typical: System Data is many unrelated things, and the clone is simply one of the easiest to remove safely.

Questions about Chrome code_sign_clone

Is com.google.Chrome.code_sign_clone a virus?

No. It is a copy of the Chrome application kept for updates. Its contents are signed by Google. If you are unsure, you can check the signature of the app inside the clone with codesign -dv, but there is no need to remove it for security reasons.

Will deleting it log me out of websites?

No. Cookies and sign-ins live in your Chrome profile, which this guide does not touch.

Can I delete the whole /private/var/folders directory?

No. It holds temporary and cache files for every app and for macOS. Removing it can break running apps and system services. Only remove the specific .code_sign_clone folders described here.

Does this affect Safari or Firefox?

Safari is updated by macOS and does not use this mechanism. Firefox does not use Chrome's updater. Other Chromium-based browsers such as Brave, Edge and Chromium itself can create their own clones, which can be removed the same way once that browser is quit.

Why does it need my password?

The private temporary area is protected. Finder asks before changing protected locations. Entering your password lets Finder move the clone to the Trash; it does not change any system setting.

References

• Apple: Storage categories and System Data
• Google: update Chrome