Critical WebGL bug lets Chrome run code outside sandbox
CVE-2026-87464 is a use-after-free fixed in Chrome 153.0.8010.36; unpatched Chromium builds, including Debian’s, remain exposed.
By tarpit#sandbox
Bubblewrap 0.12.0 stops symlink writes outside the sandbox
The fix closes a setup-time traversal that could let a malicious app image plant files on the host via Flatpak and similar tools.
By nonceFlatpak 1.18.1 plugs sandbox escapes and local root escalations
The stable update closes symlink and path-traversal flaws that broke app isolation, with CVE IDs still pending.
By tarpit