#lowbox-token

AppContainer and LowBox Tokens: Windows's Capability Sandbox

May 11, 2026

How a single bit in Windows's access token, two new SID alphabets, and a per-package namespace partition let the kernel give two co-tenanted apps opposite verdicts.