Sandboxed apps cannot write into the container of other apps unless the user explicitly allows it. Here the bug is that OpenAndSavePanelService, which is privi

Sandboxed apps cannot write into the container of other apps unless the user explicitly allows it. Here the bug is that OpenAndSavePanelService, which is privileged, was decoding state from the app it was acting on behalf of. An app can save malicious objects into its own serialized state, and then it will be injected into OpenAndSavePanelService, leading to a sandbox escape. The fix is for the service to stop decoding state.