CVE-2026-34078: Complete sandbox escape leading to host file access and code execution in the host context
Summary
A critical Flatpak security advisory discloses a sandbox escape (CVE-2026-34078) that could allow host file access and code execution from within a Flatpak sandbox. The vulnerability affects versions before 1.16.4 and is patched in 1.16.4; mitigation includes upgrading and, if needed, disabling the flatpak portal. The post highlights patch timing and recommended mitigations for system administrators.