Executive brief
A security flaw in Ubuntu's OpenJDK packages allows malicious applications restricted within a "sandbox" (like the Firefox Snap) to break out and execute code on the main system. By creating a specially crafted Java file and triggering a system-wide file handler, an attacker can gain full access to the user's files and system resources that should normally be protected. This could lead to complete system compromise if a user runs a malicious sandboxed application.
Technical details
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu due to improper handling of .jar MIME types. The vulnerability is rooted in the interaction between the OpenURI portal (via xdg-desktop-portal-gtk) and the 'cautious-launcher' wrapper provided by the mailcap package. A local attacker or malicious sandboxed application (such as a Snap) can write a malicious .jar file to the host filesystem, set the executable bit, and trigger the MIME handler to execute the file outside the sandbox environment. This occurs because the handler blindly executes files marked as executable when only a single OpenJDK runtime is installed. Canonical has released updated mailcap packages (USN-8518-1) that block the execution of JAR files through this mechanism.
Affected products
- Canonical Ubuntu openjdk-8, openjdk-11, openjdk-17, openjdk-21, openjdk-25, openjdk-lts
- Canonical mailcap less than 3.70+nmu1ubuntu1.22.04.1, 3.70+nmu1ubuntu1.24.04.1, 3.74ubuntu1.1, 3.75ubuntu1.1
Timeline
- 2026-05-19: disclosed: Initial bug report by Aaron Rainbolt
- 2026-07-08: patched: Fix released in mailcap package via USN-8518-1
- 2026-07-08: advisory: CVE-2026-10037 published