diff --git a/NodeChrome/wrap_chrome_binary b/NodeChrome/wrap_chrome_binary
index 2316a1f5b0..0f01b22ea3 100755
--- a/NodeChrome/wrap_chrome_binary
+++ b/NodeChrome/wrap_chrome_binary
@@ -6,6 +6,10 @@ mv "$WRAPPER_PATH" "$BASE_PATH"
 
 cat > "$WRAPPER_PATH" <<_EOF
 #!/bin/bash
+
+# umask 002 ensures default permissions of files are 664 (rw-rw-r--) and directories are 775 (rwxrwxr-x).
+umask 002
+
 # Note: exec -a below is a bashism.
 exec -a "\$0" "$BASE_PATH" --no-sandbox "\$@"
 _EOF
diff --git a/NodeEdge/wrap_edge_binary b/NodeEdge/wrap_edge_binary
index 48fc62df9c..93a8847924 100755
--- a/NodeEdge/wrap_edge_binary
+++ b/NodeEdge/wrap_edge_binary
@@ -7,6 +7,9 @@ mv "$WRAPPER_PATH" "$BASE_PATH"
 cat > "$WRAPPER_PATH" <<_EOF
 #!/bin/bash
 
+# umask 002 ensures default permissions of files are 664 (rw-rw-r--) and directories are 775 (rwxrwxr-x).
+umask 002
+
 # Note: exec -a below is a bashism.
 exec -a "\$0" "$BASE_PATH" --no-sandbox "\$@"
 _EOF