Re: xdg-dbus-proxy: GHSA-r7hp-698j-2h6c: broadcast message filtering bypass

xdg-dbus-proxy, the sandboxing helper that mediates D-Bus access for Flatpak applications, incorrectly filters D-Bus broadcast messages, bypassing the path, interface, and member restrictions configured for a sandbox. A malicious or compromised application running inside a Flatpak sandbox can listen for broadcast signals on the D-Bus session bus and the AT-SPI accessibility bus that should have been blocked, potentially exposing sensitive information to applications not authorized to receive it. Exploitation is local and low-impact: it requires the attacker to already control a sandboxed app on the target system and involves user interaction (e.g., the victim installing and running the malicious app), with only limited information disclosure and no integrity or availability impact (CVSS 3.2, low). All Linux systems that use xdg-dbus-proxy as part of Flatpak sandboxing are affected, with fixed versions defined in the upstream advisory GHSA-r7hp-698j-2h6c. No public proof of concept is known, the issue is not on the CISA KEV list, and there is no indication of exploitation in the wild.