Continuing the discussion from Which Flatpaks and other resources should be included in the “Downloads” section? - #4 : [image] Which Flatpaks and other resources should be included in the "Downloads" section? they weaken the sandbox (both on Firefox and Chromium). I’ve heard this before, but …

The Chromium Flatpak is patched to use Flatpak’s nested sandboxing API, because it doesn’t have access to sandboxing APIs provided by the kernel. So it’s incorrect to state that Chromium’s sandboxes are disabled just because it’s running inside a container. Flatpaks aren’t exactly the most effectiv…

Anyone can do all that if they have time, knowledge, and patient. For example, is it practical to check the manifest file every time for every app before updating? And if the source is malicious in the first place, Flatpak won’t help with anything.

Anyone can do all that if they have time, knowledge, and patient. Correct. Similar to Arch and the AUR, this is only an option for people that are knowledgeable enough and willing to do so. But the knowledge barrier isn’t tha high (for doing basic due diligence/harm reduction). Where I disagree …

Just want to link to a discussion that Cromite’s main developer had on this: Creating a Flatpak for Linux · Issue #1053 · uazo/cromite · GitHub

Thanks, it was interesting to read. Eventually Cromite dev do not recommends Flatpak for a browser. Also ungoogled chromium were concerned about it too and use some patch instead, which uazo called highly insecure.

This question relates to a post I made: Firefox and Unprivileged namespaces As presumably the situation described there and the situation with Firefox flatpak are pretty similar. I wanted to follow up and see if anybody had additional information on the importance of unprivileged namespaces to Fir…

[image] xe3: Correct. Similar to Arch and the AUR, this is only an option for people that are knowledgeable enough and willing to do so. But the knowledge barrier isn’t tha high (for doing basic due diligence/harm reduction). With yay, pkgbuilds are cached and I can only read the diffs when t…

On Flathub, projects have a public manifest repo: [image] You can then look at the commit history of the repo to see changes over time [image] [image] [image] Not as elegant of a solution, but still public and searchable

Some links to support this approach: 1882881 - Flatpak: explain how it can be as secure as native browsers UNCONFIRMED (nobody) in Firefox Build System - Third Party Packaging. Last updated 2024-03-09. 1909616 - User namespaces warning is alarmist…

[image] exaCORE: Some links to support this approach: Where are the technical arguments supporting it?

Privacy Guides Community

Does Flatpak weaken Chromium/Firefox's sandbox?

Questions

bitosi April 4, 2025, 11:12am 32

Good research. To me, it doesn’t seem to worth the risk to use the flatpak versions.

Topic		Replies	Views
Are flatpak versions of Firefox-based browsers less secure? Questions	1	1323	May 9, 2025
Firefox sandbox when installed as flatpak - is it fixed yet? Questions	5	1035	July 12, 2025
Flatpaks and browsers Questions please-eli5	2	565	January 27, 2026
Implications on Flatpak vs Package for torbrowser-rlauncher General	4	614	February 12, 2026
Don't link to Brave's Flatpak (Desktop Browsers) Site Development	4	1750	April 26, 2025

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

Does Flatpak weaken Chromium/Firefox's sandbox?

Related topics