Does Flatpak weaken Chromium/Firefox's sandbox?

The Chromium Flatpak is patched to use Flatpak’s nested sandboxing API, because it doesn’t have access to sandboxing APIs provided by the kernel. So it’s incorrect to state that Chromium’s sandboxes are disabled just because it’s running inside a container.

Flatpaks aren’t exactly the most effective sandboxes by default. However, I haven’t seen any evidence that the sub-sandboxes created by Chromium within a Flatpak container are any less effective than Chromium’s normal sandboxes. If you or someone thinks that they are less effective in a Flatpak, I’d love to see actual evidence supporting that claim.

1 Like