Comment by silon42

Yes, that why those need to be 100% sandboxed by default (ideally a VM), unless they are provided by distro