Flatpak's sandbox is pretty weak and there are many subtle loopholes that allow for trivial escapes. Relying on it as a security measure is not a great idea. A

Flatpak's sandbox is pretty weak and there are many subtle loopholes that allow for trivial escapes. Relying on it as a security measure is not a great idea. An example of such a thing, that is related to this thread, is the X11 socket being accessible even when the directory it appears to be contained in isn't bind mounted into the flakpak sandbox's mount namespace. This is because regular file system permissions do not apply to abstract sockets (which X11 can and does listen with). I think unsharing the network namespace would fix this, and configuring X11 to not listen with any abstract sockets might be possible, but this is just one of many examples of trivial sandbox escapes that most people would never even consider. The best bet to isolate untrusted software is to run it under a different UID (less safe) or inside of a VM (probably very safe).