Continuing the discussion from Which Flatpaks and other resources should be included in the “Downloads” section? - #4 : [image] Which Flatpaks and other resources should be included in the "Downloads" section? they weaken the sandbox (both on Firefox and Chromium). I’ve heard this before, but …

The Chromium Flatpak is patched to use Flatpak’s nested sandboxing API, because it doesn’t have access to sandboxing APIs provided by the kernel. So it’s incorrect to state that Chromium’s sandboxes are disabled just because it’s running inside a container. Flatpaks aren’t exactly the most effectiv…

There seems to be a need for a general information note on whether or not to install flatpak versions of Chromium and Electron-based applications. [image] qwq: Can you link some further reading on this subject? [image] Brave on Wayland General https://blogs.gnome.o…

IIRC Flatpak disables unprivileged user namespaces due to the increased attack surface they bring with them. Unfortunately, I’m fairly sure they’re utilized by Chromium/Firefox to tighten up the sandbox even more than what flatpak has. Chromium Docs - Linux Sandboxing (googlesource.com) Security/S…

In chrome://sandbox layer 1 sandbox is yellow (SUID) within flatpak but normally it is green (namespace)

For Chromium builds which natively support Flatpak’s sub-sandboxing: [BQGKRnGOglTiqUC1] For Chromium builds which don’t and use zypak instead (i.e. Brave Browser) you will see “SUID” displayed, yes, but it is not Chromium’s old SUID sandbox even though it says it is: Zypak works by using LD_PRE…

The Chromium sandbox has three main components: seccomp-filters, namespaces and chroots. Seccomp-filters are stackable and the syscall is not blocked by Flatpak’s seccomp-filter, thus the Seccomp-part of the Chromium sandboxes should stay intact. The creation of namespaces and chroots gets blocked…

You will find different statements regarding Chromium’s SUID sandbox. I found statements that it has been phased out, other statements like the one you linked say that it’s not actively developed and only in maintenance mode. It is still available to users, but the use of unprivileged user namespace…

For FF and Tor browser launcher the situation is similar. But they don’t even try to replace the namespace sandbox with flatpak-spawn. So you lose namespaces and chroots. This leads to weakened site isolation, weakened protection of the browser’s files (history, cookies, …) and also to less protecti…

MicroOS already includes Firefox’s flatpak package and something similar is planned for Silverblue . Traditional Linux distributions should install it with the package manager, as recommended on Firefox’s support page. But should immutable Linux distributions prefer the “ local Firefox installation in…

I wouldn’t use the Flatpak variant if you can get the browser through other ways. Just to be clear. For the vast majority of apps it’s good that Flatpak blocks syscalls for namespace and chroot creation because they increase attack surface quite a lot and can lead to sandbox escapes. Just for alrea…

[image] sha123: You will find different statements regarding Chromium’s SUID sandbox. Like I also said though, Flatpaks don’t even use Chromium’s SUID sandbox even if Chromium claims to be using it on the sandbox info page. As far as Firefox, yeah I’m not sure. It could very well be that Fir…

Privacy Guides Community

Does Flatpak weaken Chromium/Firefox's sandbox?

Questions

username0990 July 27, 2023, 5:06am 2

There seems to be a need for a general information note on whether or not to install flatpak versions of Chromium and Electron-based applications.

Topic		Replies	Views
Are flatpak versions of Firefox-based browsers less secure? Questions	1	1314	May 9, 2025
Firefox sandbox when installed as flatpak - is it fixed yet? Questions	5	1034	July 12, 2025
Flatpaks and browsers Questions please-eli5	2	562	January 27, 2026
Implications on Flatpak vs Package for torbrowser-rlauncher General	4	608	February 12, 2026
Don't link to Brave's Flatpak (Desktop Browsers) Site Development	4	1748	April 26, 2025

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

Does Flatpak weaken Chromium/Firefox's sandbox?

Related topics