Resolved Firefox found pre-installed on 'new' Macbook Pro? (Nah, it's all good!)

[Jolanxbl]

Final Update:
I spoke with an AppleCare manager and he said that while the M4 started distribution in 2024, our model may have been assembled in late 2025. So we bought a late model ¯\_(ツ)_/¯. Good enough resolution. The Apple guy also said that the 'drag to install' window is added by the developers, not the OS. So, we'll set the Security setting to "Apple Store only" setting & see how that goes with future software.

Thank you to all the participants in this excursion; I was prepared for a low turn-out but very pleasantly surprised at the quick responses. Every comment triggers a line of thought.

------
** 2 updates in the comments
==========
We bought a new macbook pro 2024 model from Staples on March 11 2026, and tried installing Firefox 148.0.2 on March 19. The installer says there's already a copy installed, and Get Info shows Creaded & Modified as March 9 at 8:14 am! Next, we opened Terminal & ran "last reboot". It shows wtmp begins Oct 15, 2025 at 10 am, and rebooted twice on that day. What's going on? This computer is supposed to be brand new, and even if refurbished, why is non-factory software installed after a factory reset, only 2 days prior to purchase, and we were still greeted by the initial setup screens?

Other apps are showing Created times from January 2026. If those dates are from when they were added to the OS version, that still doesn't explain Firefox being there so recently.

The OS version when it was opened was Sequoia 15.6 and we updated it to 15.7.4 on March 17, 2026. And, even if she accidentally installed it today, and the Created date is when that version of Firefox was last uploaded to their website, as the computer is new, it should have given a warning about installing software that isn't from the Mac store.

 

[FreakinEurekan]

Sounds like not exactly "brand new."

You can do a full erase if you want to be sure you're starting from scratch - Apple menu > System Settings > General > Transfer or Reset > Erase All Contents & Settings

 

[Jolanxbl]

Update: Here are all the date & info I've discovered since:

Macbook model 2024
Sequoia 15.6 installed July, 2025
Terminal shows wtmp started, then rebooted twice October 15, 2025
Purchased NEW March 11, 2026
> If the model is 2024, why is ANYONE accessing it in 2025?

Firefox installer created March 9, Public release March 10. "Created/Modified" date of the .app: March 9.
Terminal, kMDItemDateAdded = 2026-03-19 17:44:38
> It is now 2pm, how could the application have been created 4 hours from now?

Apple's OS is very cautious about installing new applications, and will either give a warning or, at least, present the user with "drag this file icon to the right" dialog to install the app. If Firefox is regarded as a 'trusted developer', and the .dmg file was accidentally double-clicked, would that skip the drag-this-file window when first installing it?

 

[Bigwaff]

Was does output of last show you in Terminal?

 

[MacMorrison]

That sounds suspicious. I'd get an external USB drive to wipe the entire system and install Sequoia from scratch.

You can download macOS Sequoia here: https://apps.apple.com/us/app/macos-sequoia/id6596773750?mt=12

Then install it to an external USB SSD or hard drive and download the installer from there (and wipe the internal drive completely).

You can wipe the MacBook's firmware with a Device Firmware Update (DFU) restore using a 2nd Mac - the process is a bit involved so you may want to take it to an Apple store or certified service shop:

https://support.apple.com/en-us/108900

 

[Jolanxbl]

Update 2:
We installed Thunderbird, then ran the same checks to compare. kMDItemDateAdded looks to be using GMT rather than my current timezone, as it was ahead as well. The created date is also not today, so that aligns with when the installer was packaged. I spoke with an authorized repair store about the computer having been accessed last year, and he says that Apple tries to send out the most up-to-date versions. My theory now is that the laptop sat dormant in Apple's possesion for a year, they then updated it to the latest (at the time) version of Sequoia before resealing the box and shipping to a retailer to deal with. Now, I will try to get a hold of Apple, with the serial number, and see if it all pans out.

The concern that my friend has, which started all this, was whether the unit had been tampered with, or returned but then marked as New for a maximum sale.

 

[Bigwaff]

You must have gotten a great deal to justify going through all this trouble rather than simply returning for exchange or refund.

 

[FreakinEurekan]

Choice one: Wipe it (no need to DFU, just use Erase All Contents & Settings as I mentioned earlier - macOS is on a protected volume; that's fine.)

Choice two: Return it.

Nothing else to debate, really. Pick one ¯\_(ツ)_/¯

 

[Jolanxbl]

"You must have gotten a great deal to justify going through all this trouble rather than simply returning for exchange or refund."
There was a sale and also additional discount for a damaged package. But as a Windows user who will stay awake manually cleaning out malware or troubleshooting hardware, I like to know why the computer is doing or showing something strange.

Final Update:
I spoke with an AppleCare manager and he said that while the M4 started distribution in 2024, our model may have been assembled in late 2025. So we bought a late model ¯\_(ツ)_/¯. Good enough resolution. As for the browser, we're going with my friend just instinctively added it without thinking. The Apple guy also said that the 'drag to install' window is added by the developers, not the OS.

Thank you to all the participants in this excursion; I was prepared for a low turn-out but very pleasantly surprised at the quick responses. Every comment triggers a line of thought.

 

[goldmac2006]

"You must have gotten a great deal to justify going through all this trouble rather than simply returning for exchange or refund."
There was a sale and also additional discount for a damaged package. But as a Windows user who will stay awake manually cleaning out malware or troubleshooting hardware, I like to know why the computer is doing or showing something strange.

Final Update:
I spoke with an AppleCare manager and he said that while the M4 started distribution in 2024, our model may have been assembled in late 2025. So we bought a late model ¯\_(ツ)_/¯. Good enough resolution. As for the browser, we're going with my friend just instinctively added it without thinking. The Apple guy also said that the 'drag to install' window is added by the developers, not the OS.

Thank you to all the participants in this excursion; I was prepared for a low turn-out but very pleasantly surprised at the quick responses. Every comment triggers a line of thought.

Sorry for being LTTP here but this is an interesting read. My MacBook Pro is same model year M4 Pro as you and I never had any issues like any third party apps installed already after I set it up as new, as BNIB. I used quick start for easy Apple account sign in

In context, did you use quick start and/or any form of backup restoration including Time Machine on your Mac ?

 

[Jolanxbl]

Sorry for being LTTP here but this is an interesting read. My MacBook Pro is same model year M4 Pro as you and I never had any issues like any third party apps installed already after I set it up as new, as BNIB. I used quick start for easy Apple account sign in

In context, did you use quick start and/or any form of backup restoration including Time Machine on your Mac ?

I would LOVE if I could ever get a hold of Linus (if LTTP is Linus Tech Tips). We went with the resolution that is

1. Firefox was installed without even thinking about it through 'muscle memory' - Mac's don't often use an installer dialog box; it's just click-drag.
2. The file's Created date was when the .app file was created, not installed. That version of FF was dated 1 day BEFORE it was released publicly.
3. The system being accessed in 2025 is Apple updating the 2024 model before releasing stock to other retailers. Staples said that they don't sell refurbished in-store, and open-box models come with a yellow seal that you can't miss when unpacking it.

 

[goldmac2006]

I would LOVE if I could ever get a hold of Linus (if LTTP is Linus Tech Tips). We went with the resolution that is

1. Firefox was installed without even thinking about it through 'muscle memory' - Mac's don't often use an installer dialog box; it's just click-drag.
2. The file's Created date was when the .app file was created, not installed. That version of FF was dated 1 day BEFORE it was released publicly.
3. The system being accessed in 2025 is Apple updating the 2024 model before releasing stock to other retailers. Staples said that they don't sell refurbished in-store, and open-box models come with a yellow seal that you can't miss when unpacking it.

Oh, I was thinking of LTTP as “late to the party,” but it does suggest Linus Tech Tips too! We should send a tip to that YouTuber to chat about this macOS mystery!


And you’re right—all macOS app developers make you double-click or drag to the Applications folder to install DMGs or use Installer. You can’t go past that for almost every single third-party app. and I agree  might have updated the Mac to later macOS sequoia version before packaging it and shipping it out. My Mac came with 15.6 as its macOS version out of the box, but I got mines months before the M5 launched.