You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
SandboxArea: what it touches
New FeaturesKind: in v2.1.248,
New FeaturesSection of the release
What
When a sandboxed agent asks for a permission decision, the code that collects answers now checks that the answer came back for the same host that made the request, not just the same request id. A mismatched answer is refused and logged. Always on.
Details
Previously only the request id was compared, so an answer produced on another machine could be applied.
Hardening only; there is no flag and no behaviour change when everything matches.
Evidence
answered for a different host
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
