Proton Mail
Encrypted email and calendar
![]()
Proton Mail desktop for Mail and Calendar. This Flatpak wraps the official Linux RPM with zypak. It is not a vendor-official Flatpak and not the community Flathub wrapper.
Proton Mail is proprietary freeware; this Flatpak is a redistribution of the official RPM, not vendor official.

Install
flatpak --user remote-add --if-not-exists thepeoples \
https://flatpak.thepeoples.io/thepeoples.flatpakrepo
flatpak --user install -y thepeoples io.thepeoples.ProtonMail
flatpak --user install -y thepeoples io.thepeoples.ProtonMail//1.14.0Optional system install uses sudo flatpak remote-add --if-not-exists --system and sudo flatpak install -y --system. The //version form pins the advertised ostree branch; stable tracks the latest advertised tree.
Previous versions
The remote keeps the current tree plus the last two vendor versions as extra ostree branches for rollback. Objects stay on the remote after a branch is dropped (publish does not delete).
- Version
1.13.4(ostreeb50013c526289d06bf94fb139523a098570045a52ce5bde4c058ea3f45248a51)
flatpak --user install -y thepeoples io.thepeoples.ProtonMail//1.13.4Verify
- App id
io.thepeoples.ProtonMail, vendor Proton AG, version1.14.0, license proprietary - Download 124.2 MB · installed 325.7 MB
- sha256
6c429e8d94ea57da24b83a49cbe98ce3f37f11d72b4dc0e314a473ce7d03c4b0 - sha512
0b4ba742b86754bf2a85672096eeca0baa14799044ba4129c2d96668db8a111bd8ad3bc0769ace711e505bde3712251a4933fb0c5702dffe9a32193918f476be(official source, checked after download fromhttps://proton.me/download/mail/linux/version.json) - Ostree key fingerprint
98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841 - Homepage https://proton.me/mail
Input scan
Pinned rpm ProtonMail-desktop-beta.rpm, extracted without install scripts, scanned before wrap. 2026-10-14 19:38 UTC · trivy 0.73.0 · vuln DB 2026-10-14.
Wrap
Layers this remote adds. Gate fails on CRITICAL.
none
gate pass
Vendor
In the upstream package. Not patched here.
4 HIGH
Vendor findings 4 · 4 HIGH
| Severity | ID | Package | Installed | Fixed | Title |
|---|---|---|---|---|---|
| HIGH | CVE-2026-102674 | electron | 42.9.0 | 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5 | electron: Electron: Sandbox bypass via popup window creation |
| HIGH | CVE-2026-102675 | electron | 42.9.0 | 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5 | electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers |
| HIGH | CVE-2026-102676 | electron | 42.9.0 | 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5 | electron: electron: Privilege escalation via unauthorized Node.js integration in web workers |
| HIGH | CVE-2026-102677 | electron | 42.9.0 | 42.10.0, 43.5.0, 44.0.0-beta.6 | electron: Electron: Privilege escalation via sandboxed preload code cache poisoning |
Previous scans
Daily Trivy refresh. Current report plus the last 14 full scans; older copies are deleted.
| Scanned | Vuln DB | Version | Wrap | Vendor | Report |
|---|---|---|---|---|---|
| 2026-10-14 06:50 UTC | 2026-10-14 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-13 06:57 UTC | 2026-10-13 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-12 09:28 UTC | 2026-10-12 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-12 06:50 UTC | 2026-10-12 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-11 06:51 UTC | 2026-10-11 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-10 06:51 UTC | 2026-10-10 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-09 06:51 UTC | 2026-10-08 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-08 19:31 UTC | 2026-10-08 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-08 06:51 UTC | 2026-10-07 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-07 06:51 UTC | 2026-10-07 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-10-06 06:51 UTC | 2026-10-06 | 1.14.0 | none | 4 HIGH | JSON |
| 2026-09-27 07:34 UTC | 2026-09-27 | 1.14.0 | none | none | JSON |
| 2026-09-27 06:52 UTC | 2026-09-27 | 1.14.0 | none | none | JSON |
| 2026-09-26 07:08 UTC | 2026-09-26 | 1.14.0 | none | none | JSON |