Proton Mail

Encrypted email and calendar

Proton Mail desktop for Mail and Calendar. This Flatpak wraps the official Linux RPM with zypak. It is not a vendor-official Flatpak and not the community Flathub wrapper.

Proton Mail is proprietary freeware; this Flatpak is a redistribution of the official RPM, not vendor official.

emailmailcalendarprotonencrypted

Proton Mail
Proton Mail

Install

flatpak --user remote-add --if-not-exists thepeoples \
  https://flatpak.thepeoples.io/thepeoples.flatpakrepo
flatpak --user install -y thepeoples io.thepeoples.ProtonMail
flatpak --user install -y thepeoples io.thepeoples.ProtonMail//1.14.0

Optional system install uses sudo flatpak remote-add --if-not-exists --system and sudo flatpak install -y --system. The //version form pins the advertised ostree branch; stable tracks the latest advertised tree.

Previous versions

The remote keeps the current tree plus the last two vendor versions as extra ostree branches for rollback. Objects stay on the remote after a branch is dropped (publish does not delete).

  • Version 1.13.4 (ostree b50013c526289d06bf94fb139523a098570045a52ce5bde4c058ea3f45248a51)
flatpak --user install -y thepeoples io.thepeoples.ProtonMail//1.13.4

Verify

  • App id io.thepeoples.ProtonMail, vendor Proton AG, version 1.14.0, license proprietary
  • Download 124.2 MB · installed 325.7 MB
  • sha256 6c429e8d94ea57da24b83a49cbe98ce3f37f11d72b4dc0e314a473ce7d03c4b0
  • sha512 0b4ba742b86754bf2a85672096eeca0baa14799044ba4129c2d96668db8a111bd8ad3bc0769ace711e505bde3712251a4933fb0c5702dffe9a32193918f476be (official source, checked after download from https://proton.me/download/mail/linux/version.json)
  • Ostree key fingerprint 98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841
  • Homepage https://proton.me/mail

Input scan

Pinned rpm ProtonMail-desktop-beta.rpm, extracted without install scripts, scanned before wrap. 2026-10-14 19:38 UTC · trivy 0.73.0 · vuln DB 2026-10-14.

Wrap

Layers this remote adds. Gate fails on CRITICAL.

none

gate pass

Vendor

In the upstream package. Not patched here.

4 HIGH

Vendor findings 4 · 4 HIGH
SeverityIDPackageInstalledFixedTitle
HIGHCVE-2026-102674electron42.9.041.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5electron: Electron: Sandbox bypass via popup window creation
HIGHCVE-2026-102675electron42.9.041.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers
HIGHCVE-2026-102676electron42.9.041.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5electron: electron: Privilege escalation via unauthorized Node.js integration in web workers
HIGHCVE-2026-102677electron42.9.042.10.0, 43.5.0, 44.0.0-beta.6electron: Electron: Privilege escalation via sandboxed preload code cache poisoning

Full report (JSON)

Previous scans

Daily Trivy refresh. Current report plus the last 14 full scans; older copies are deleted.

ScannedVuln DBVersionWrapVendorReport
2026-10-14 06:50 UTC2026-10-141.14.0none4 HIGHJSON
2026-10-13 06:57 UTC2026-10-131.14.0none4 HIGHJSON
2026-10-12 09:28 UTC2026-10-121.14.0none4 HIGHJSON
2026-10-12 06:50 UTC2026-10-121.14.0none4 HIGHJSON
2026-10-11 06:51 UTC2026-10-111.14.0none4 HIGHJSON
2026-10-10 06:51 UTC2026-10-101.14.0none4 HIGHJSON
2026-10-09 06:51 UTC2026-10-081.14.0none4 HIGHJSON
2026-10-08 19:31 UTC2026-10-081.14.0none4 HIGHJSON
2026-10-08 06:51 UTC2026-10-071.14.0none4 HIGHJSON
2026-10-07 06:51 UTC2026-10-071.14.0none4 HIGHJSON
2026-10-06 06:51 UTC2026-10-061.14.0none4 HIGHJSON
2026-09-27 07:34 UTC2026-09-271.14.0nonenoneJSON
2026-09-27 06:52 UTC2026-09-271.14.0nonenoneJSON
2026-09-26 07:08 UTC2026-09-261.14.0nonenoneJSON