Run the following command in the Terminal (Spotlight -> "Terminal" and select the app; alternatively it lives under /Application/Utilities): $ sudo lsof | grep libsmime3 This should give you output like this: vpnagentd 59 root txt REG 14,2 267408 42784841 /Applications/Firefox.app/Contents/MacOS/libsmime3.dylib You might get back "firefox-bin" which means you have a copy of Firefox still running. Close Firefox and then try to copy it over (need to wait for it to fully quit). If it doesn't appear to be running, use Activity Monitor to locate and kill the process. On my system a process called "vpnagentd" which corresponds to the "Cisco AnyConnect VPN Client" for some reason had clung onto this file. It feels like a side effect of a poorly written application or a missing dependency. If you have any active tunnels, now would be a good time to terminate them. The most important column is the second one. This contains the process ID that we need. Since this is owned by root, we need to use sudo again to kill it: sudo kill 59 In my case, the vpnagentd process respawned faster than I was able to copy Firefox in place. In that instance I took the file path and deleted the file: rm /Applications/Firefox.app/Contents/MacOS/libsmime3.dylib And then I killed all vpnagentd processes: sudo killall vpnagentd And at this point I tried to copy over and got an error with a file called "libplds4.dylib". Looking through lsof I found the following: vpnagentd 4178 root txt REG 14,2 92260 42784839 /Applications/Firefox.app/Contents/MacOS/libplds4.dylib Again, vpnagentd is the source of pain. This time I decided to take a more sledgehammer approach and deleted any dylib (the update will replace them): rm /Applications/Firefox.app/Contents/MacOS/*.dylib And killall vpnagentd processes for good measure: sudo killall vpnagentd At this point you should have no issues copying Firefox and updating it. This doesn't appear to impact on the Cisco AnyConnect VPN as when those files are unavailable it doesn't appear to need them anyway.