Applications hosting system extensions

Certain applications that provide functionality at the operating system level (such as Little Snitch) ship with an embedded system extension.

Because these extensions have elevated privileges to perform their tasks, both their installation and removal are subject to special security requirements managed by the operating system.

For example, these extensions are installed in a dedicated area of the file system protected from unauthorized modifications by SIP. Consequently, removing such software is more involved because you must remove not only the app itself but also its associated extensions.

Whenever you attempt to delete such an application by moving it to the Trash, macOS informs you that this action also affects the system extensions included with the app.

That’s actually quite nice. You don’t have to worry about removing these extensions yourself—your Mac takes care of it automatically and uninstalls all the extra bits. Or does it?

Starting with macOS 15.3, this automatic removal of embedded system extensions no longer works. Although the system still claims to remove them, they remain installed and active, so they continue to run in the background without users even noticing.

Note that this affects not only Little Snitch but also all third-party Mac apps that include a system extension, such as VPN and network filtering apps, endpoint security tools, and hardware drivers.

But wait, there’s more

If the application in question not only includes a system extension but also happens to be protected against unauthorized deletion by root ownership of its application bundle (as is the case with Little Snitch), there’s another problem.

Usually, when you attempt to delete an app that you don’t own, Finder presents a password dialog where you can authenticate as an administrator to authorize the deletion.

However, starting with macOS 15.3, this dialog is no longer shown when this app also hosts a system extension that’s currently installed. Instead, you just get this vague error message:

What to do?

Well, waiting for Apple to fix these bugs is probably not an option if you want to uninstall the app right away.

However, you can manually delete the installed system extension(s) prior to moving the app to the Trash.

To do this, follow these steps:

1. Open System Settings.
2. Select General > Login Items & Extensions.
3. Scroll down to the Extensions section.
4. Click the i icon next to “Network Extensions”.
5. Click the action icon (three dots) and choose “Delete Extension” from the menu.

If you also have the Endpoint Security extension installed, delete this extension as well by clicking the i icon next to “Endpoint Security Extensions” and deleting the extension there.

Now you should be able to move the app to the Trash, without even being prompted about the embedded extensions anymore.

Alternatives

Instead of deleting Little Snitch, you might, of course, also consider keeping it installed and letting it continue to protect your privacy. 😉