XDG Desktop Portal Vulnerability in File Transfer Mechanism

CVE-2026-55889

What is CVE-2026-55889?

The XDG Desktop Portal, designed for seamless desktop integration, has a vulnerability that allows malicious sandboxed applications to exploit the FileTransfer.RetrieveFiles method. This flaw can be utilized to redirect drag-and-drop and copy-paste data exercises from other applications to the attacker’s application. Previous implementations generated tokens using GLib's Mersenne Twister PRNG, leading to predictability in token generation. This predictability gives attackers the means to recover the state of the random number generator, enabling them to anticipate subsequent tokens and gain unauthorized access to resources. The vulnerability has been effectively addressed in version 1.22.1.

References