CVE-2026-55889

The xdg-desktop-portal desktop integration portal is vulnerable to data theft via predictable FileTransfer keys prior to version 1.22.1 . Malicious sandboxed applications can exploit the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data intended for other application...

CVE-2026-55889 XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...