New Update Sandboxie-Plus v1.18.8 / 5.73.8 Latest

[bjm_]

Release v1.18.8 / 5.73.8 Latest​

Sandboxie Plus 1.18.8 / Classic 5.73.8 brings important compatibility improvements for Firefox and other sandboxed browsers, with a particular focus on fixing video playback issues.
Video playback now works correctly in sandboxed Firefox on websites such as ESPN that rely on mediaCapabilities.decodingInfo() to check media support before starting playback. This resolves an issue that could leave videos unable to start on affected sites.
The release also improves AppContainer handling used by browsers and other applications to isolate their child processes. Fixes address missing sandbox permissions and overly restrictive substitute tokens that could prevent these processes from starting or accessing required system resources. Microsoft Edge can again use the corrected substitute token without enabling UnRestrictAppContainerToken by default.
A security fix addresses an out-of-bounds read in the GUI proxy’s MapWindowPoints handler that could expose service heap data to sandboxed callers. The Import Boxes workflow has also been corrected, allowing users to choose where imported sandboxes are created.
For existing sandboxes, the new fixboxdacls command in KmdUtil.exe adds missing AppContainer access permissions. Advanced configuration options provide additional control: KeepBroadGroupsInAppContainerToken=n restores the previous all-deny-only substitute token behavior, NeutralizeLowBoxToken=n allows direct NtCreateLowBoxToken calls through, and FakeAppContainerToken=n now allows sandboxed programs to create real AppContainer child processes.

For a full list of changes please review the change log.

You can support the project through donations, any help will be greatly appreciated.
If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.

https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.18.8
https://www.wilderssecurity.com/threads/sandboxie-plus-1-18-8-released.461009/
https://www.patreon.com/DavidXanatos/posts/sandboxie-plus-1-172656144
https://forum.xanasoft.com/threads/sandboxie-plus-1-18-8.13155/
https://sandboxie-plus.com/downloads/

 

[Bot]

Hi bjm_, thanks for the update. This is a worthwhile maintenance release for anyone sandboxing Firefox, Edge, or other applications that use Windows AppContainer processes.

The most important points are:

• Firefox media compatibility: sites waiting for mediaCapabilities.decodingInfo()—including ESPN—should no longer leave playback stuck.
• AppContainer fixes: missing access-control entries (ACEs), restricted substitute tokens, CDM-process crashes, and SBIE2204/RpcSs failures are addressed.
• Security fix: the MapWindowPoints out-of-bounds read allowed a sandboxed caller to obtain data from the Sandboxie service heap. The official changelog does not describe this as a sandbox escape or code-execution vulnerability, but an information leak can still assist exploit chaining, so updating is sensible.
• Existing boxes: if an older box still produces 0xC0000022, media/CDM crashes, or related AppContainer failures, the new KmdUtil.exe fixboxdacls command is specifically intended to add the missing AppContainer permissions.

Most users should leave the new advanced token settings at their corrected defaults. They are compatibility controls, not mysterious “more secure” switches to toggle just because the names look impressive.