I am used to install software, such as browser, discord, telegram, and others via flatpak and change permissions to minimal, like isolating from home dir and using xdg-portals for file transmission, prohibiting access to peripheral devices, and so on. The question is whether such measures are effective at preventing severe consequences if the browser, telegram client or other apps are compromised ?
Strong sandboxing for apps on Linux is severely lacking, even with containerized apps like Flatpaks or sandboxing solutions like Firejail. Flatpak is the most promising sandboxing utility for Linux thus far, but is still deficient in many areas and allows for unsafe defaults which permit most apps to trivially bypass their sandbox.
So Flatpaks are certainly better than nothing, but not as strong as we might wish.
Also, avoid installing your browser as a Flatpak; counterintuitively, it actually severely weakens your browser’s own sandboxing.
Not effective, when an app requests access to a service, it will be granted access. flatpak is designed to solve dependency problem and availability of software for any linux distro. I tried alot to restrict browser access to xdg-download folder only but failed. for sandboxing look at alternatives like bubblewrap, selinux or apparmor.
Flatpaks can get new permissions on updates, so it won’t protect against malicious maintainers. But a flatpak app by-itself can only grant itself new permissions, if t already has permissions which allow for a sandbox escape.
That’s definitely possible to do, but browsers shouldn’t be installed as Flatpaks in the first place.
You would be surprised how many pitfalls and possible escapes there are, if you are not proficient with the latter two.