# Sandbox policy enforced inside sandbox

Security checks decided in the constrained process, or compared against the wrong type or value

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-07-30. Updated 2026-10-31._

## How it works
A security decision is made by code on the untrusted side of the boundary, or against a value that is not what the author assumed at check time. Two assumptions break. First, that the enforcing code cannot be influenced by the party it constrains: when the check lives in the sandboxed process, compromising that process flips the outcome. Second, that the checked variable has its final type and value at the comparison: when a default is applied after the check, an omitted option slips past a strict comparison and the dangerous default takes effect.

## Where it shows up
- Auth routines that read a credential then never compare it, setting an authenticated flag unconditionally [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md)
- Capability defaults that enable dangerous behavior (module loading, plugin paths) unless explicitly disabled [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md)
- Guards using `=== false` / `=== true` where the value may be `undefined` at check time [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m4wx-m65x-ghrr.md)
- Defaults applied after the guard (destructuring defaults) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m4wx-m65x-ghrr.md)
- Sandbox/isolation flags (contextIsolation, nodeIntegrationInSubFrames) checked in renderer-side code [E3](https://bugbountylibrary.com/r/h1%3A1647287.md)

## How to review
Identify the trust boundary and confirm the enforcing code runs on the trusted side. For each guard, trace the actual runtime type and value of the checked variable at the point of comparison, and confirm defaults are applied before, not after, the check. For auth, confirm the credential value is compared, not just its length. For capability flags, confirm the safe value is the default and enabling requires an explicit trusted decision. The invariant: no security-relevant decision may depend on state the constrained process can set.

## Variants seen
- Auth cookie length checked, value ignored, authenticated set true [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md)
- Module loading on by default; arbitrary plugin path passed to dlopen with no allowlist [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md)
- Strict-equality guard bypassed by omitted option resolving to the dangerous default later [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m4wx-m65x-ghrr.md)
- Isolation flags enforced in the renderer, flippable by a renderer compromise [E3](https://bugbountylibrary.com/r/h1%3A1647287.md)

## Why fixes fail
E2 is itself a patch regression: the fix for an earlier issue introduced the strict-equality guard, and the later default assignment reopened the hole. A guard added without checking the variable's type at that point can be bypassed by omission.

## Impact and severity
High: sandbox escape to full user context [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md), full host RCE from a Node vm sandbox [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-m4wx-m65x-ghrr.md), and exposure of privileged IPC from a compromised renderer with possible RCE [E3](https://bugbountylibrary.com/r/h1%3A1647287.md). Severity rises when the bypass needs no special input (omitted option, default-on module loading) and when the exposed capability is arbitrary code loading or privileged IPC.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-m4wx-m65x-ghrr.md
- E3: https://bugbountylibrary.com/r/h1%3A1647287.md