I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine. I understand that there are two common ways of sandboxing this software: you can either download the standalone Zoom application and then run it with the aid of some access control system, such as Firejail or AppArmor, or you can join the videoconference via Chromium, which will prompt the browser to download and run Zoom in its own sandboxed environment.

Another question here addresses the difference between Firejail and AppArmor (for the general case, not just for Zoom). But what are the differences between running an application in a Firejail sandbox versus running it in a Chromium sandbox? Using Chromium seems to be more convenient, since it doesn't require the user to separately download and install an access control system and the standalone application. But are there any differences from a security point of view? Do Chromium-sandboxed applications have access to any parts of one's system that Firejail-sandboxed applications do not, or vice versa? Are there any other advantages or disadvantages to consider?

(Note that although this question arose from pressure to use Zoom, I'm really interested in the more general issue of how Firejail and Chromium differ in their approach to sandboxing. I understand that the standalone Zoom application may differ in behaviour from the browser-based version that Chromium runs and so answers need not necessarily address any security risks specific to Zoom.)


The browsers do not allow application to directly access the filesystem. They can only:

  • Ask the user to upload a file of their choosing.
  • Start downloading a file that will be safe in the directory chosen by the user (by default the "Downloads" directory).

Installed applications can have a full access to the filesystem.

On top of that, further restrictions can be added by Firejail or Apparmor to limit the access to the filesystem (among other resources). Those restriction can be applied to any applications, including browsers. So instead of choosing between a Chromium sandbox and a Firejail sandbox, you can use both.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.