Basically, all the clients that connect to an Xserver has full trust in each other. You can sniff on any event sent to any client, and send fake events (that ar

Basically, all the clients that connect to an Xserver has full trust in each other. You can sniff on any event sent to any client, and send fake events (that are not detectable as fake) to any client, as well as read all the contents of any windows. This essentially means any client can do whatever the user can do. People have tried to make it more secure in various ways (trusted X, selinux X), but it is impossible because so much of the way X does things like DnD, cut-and-paste, window managers, etc that its just not possible to separate clients from each other without the entire thing breaking.