Post #3580772

2026-07-04 13:33 UTC

KDE has a history of doing that. Plasma widgets are a gaping security hole. You can poke a hole through root. I’m pretty sure you can traverse up the JS object hierarchy from a widget and modify the whole desktop in anyway you want. At least at some point this was possible. Their response was basically “works as intended” and closed the issue.

Replies (2)

@Zamundaaa@discuss.tchncs.de 2026-07-05 12:53

Plasma widgets are a gaping security hole. Aka “thing that isn’t sandboxed, never has been sandboxed, and never has been claimed to be sandboxed, is in fact not sandboxed”. Just like any app from your distro repositories, or appimages, or games in Steam… Or even most Flatpaks by default for that matter. Widgets being sandboxed would be cool and is a long term goal (which is way easier said than done!), but don’t present them not being sandboxed as some irresponsible thing someone does because they don’t care. Your expectations of security simply are simply completely misplaced.

Open ##3604314
@HaraldvonBlauzahn@feddit.org 2026-07-05 14:27

KDE has a history of doing that. Plasma widgets are a gaping security hole. OMG, did they copy Microsoft’s “Active Desktop”? Sounds like this exactly.

Open ##3606026