xdg-dbus-proxy 0.1.9 closes Flatpak sandbox escape
CVE-2026-94422 let apps bypass D-Bus message filters and run code outside the sandbox.
By tarpit#sandbox
Critical WebGL bug lets Chrome run code outside sandbox
CVE-2026-87464 is a use-after-free fixed in Chrome 153.0.8010.36; unpatched Chromium builds, including Debian’s, remain exposed.
By tarpitBubblewrap 0.12.0 stops symlink writes outside the sandbox
The fix closes a setup-time traversal that could let a malicious app image plant files on the host via Flatpak and similar tools.
By nonceFlatpak 1.18.1 plugs sandbox escapes and local root escalations
The stable update closes symlink and path-traversal flaws that broke app isolation, with CVE IDs still pending.
By tarpit