Bottles 67.2 closes a UMU sandbox escape and fixes three bugs in under 36 hours
Following a lightning-quick 36-hour turnaround since 67.1, Bottles 67.2 is now live, and it's mostly about closing a sandbox escape vector that left UMU-launched Windows apps wide open to your entire filesystem.
For the uninitiated, Bottles wraps Wine, Proton, and its derivatives into a GTK4/Libadwaita interface that lets Linux users install and run Windows software without juggling command-line flags. It ships almost exclusively as a Flatpak or cpak container, relying heavily on sandboxing to keep host files safe. That's exactly what this release tightens.
The sandbox fix everyone should grab
The main update is a security patch reported just yesterday by a Fedora user running dual GPUs. Before the patch, games routed through the UMU launcher in dedicated sandbox mode were handed access to the full host filesystem the Flatpak could reach. Not the bottle prefix. The whole thing. Including Bottles' own data directory at ~/.var/app/com.usebottles.bottles/. In short, any untrusted Windows executable you dragged through UMU could read or write files it had no business touching. The fix is straightforward: stop exposing the host root to UMU sandboxes, aligning it with how the app handles regular non-UMU workloads.
To be fair, the UMU launcher itself is a bit of an open-source rabbit hole. It's a community-driven tool that gives non-Steam games SteamRT container support, meaning you get Valve's dependency isolation without actually opening Steam. Bottles integrated it last year for users who want that sandboxing without the Valve client. But integrating a third-party runtime into a sandboxed Flatpak is where things usually get messy, and this patch is Bottles finally pulling the strings tight.
Next to the sandbox lockup, 67.2 tackles two nagging crashes. One is a Proton font symlink regression that breaks apps relying on Tahoma, specifically QtWebEngine processes that null-pointer right through your desktop session. The maintainer's fix mirrors what Valve's own Proton does by default, but which Bottles had been skipping during runner updates. The other is an Arch Linux-specific issue where the installer icon fetcher chokes on HTTP 403 errors and takes the whole app down with it. Now it just falls back to a placeholder icon.
On the feature side, the release adds Stripe card and Revolut payment options to the in-app donation dialog, widening the financial runway beyond GitHub Sponsors for a project that's heavily used across Europe. There's also sandbox parity for cpak-packaged games, meaning file grants now pass through to dedicated mode the same way they do for Flatpak users. And as a follow-up to the UMU fix, the cpak packaging itself is restricted to Bottles' own data directory, cutting down another potential attack surface.
It's a modest release on the surface, but the security angle makes it worth a quick update. Not bad for a single maintainer working on it alongside his day job on Vanilla OS 2. Mirko Brombin (mirkobrombin) authored every line in 67.2, and the roughly 1.5-day gap between 67.1 and 67.2 is unusually fast for a project that usually moves at its own pace. The community's already weighing in: the UMU issue alone pulled in seven reactions in under 24 hours.
Update via Flathub for the Flatpak, or head over to cpak.it for the container variant. The release notes live at GitHub.
