AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← Malware catalog

Attributed metadata history

REPORTPUBLIC METADATA

Supporting Wayland’s XDG activation protocol with Gtk/Glib

One of the biggest sore points with Wayland is its focus stealing protection. The idea is good: an application should not be able to bring itself into focus at an unexpected time, only when the currently active application allows it. Support is still lacking however, which might also be due to Gtk/Glib implementing the required XDG activation protocol but not really documenting it. It took me a bit of time to figure this out without any public information, this article will hopefully make things easier for other people. Contents How the XDG activation protocol works State of implementation in Gtk/Glib Starting applications via Gio.AppInfo Starting applications by other means How the XDG activation protocol works The main idea behind the XDG activation protocol is that focus transfer from one application to another requires consent. With X11 a file manager could just launch the browser for an HTML file and the browser would immediately take focus, even if that browser was already running. With Wayland the file manager has to indicate that the browser is allowed to take focus. It does that by giving the browser its XDG activation token, typically via XDG_ACTIVATION_TOKEN environment variable. The browser can then use that activation token to prove consent and take focus. For this to work the protocol has to be supported on both ends: the file manager must know how to retrieve an activation token and pass it on via XDG_ACTIVATION_TOKEN environment variable, and the browser has to know how to use that token. State of implementation in Gtk/Glib The receiving side has been implemented in Gtk with merge request 7118 and is available starting with Gtk 4.14.6 and 4.15.1. This is the unproblematic part: it is handled automatically and doesn’t require the application developer to change anything. The sending side has been implemented in Gtk with merge request 3502 and Glib with merge request 3090, so it is available starting with Gtk 4.10.0 and Glib 2.75.1. This is the part which might require some changes to the application – changes that I couldn’t find documented anywhere. Starting applications via Gio.AppInfo When a Gtk-based file manager wants to open an HTML file, this usually involves Gio.AppInfo and g_app_info_launch or similar: GAppInfo* app_info = g_app_info_get_default_for_type("text/html", TRUE); GList *list = NULL; list = g_list_append(list, "https://example.com/"); GdkDisplay *display = gdk_display_get_default(); GdkAppLaunchContext* context = (display ? gdk_display_get_app_launch_context(display) : NULL); g_app_info_launch_uris(app_info, list, G_APP_LAUNCH_CONTEXT(context), NULL); g_list_free(list); This should normally transfer focus to the browser automatically. That app launch context parameter is important however, you cannot omit it. Also, this will only work if the desktop file corresponding to the AppInfo has the StartupNotify key set – the Gtk developers decided to merge the handling of X11 startup notifications and XDG activations. Starting applications by other means But what if you are using something like execve function to start applications? You can still set XDG_ACTIVATION_TOKEN environment variable manually. It’s important to know however that the token has to be retrieved via g_app_launch_context_get_startup_notify_id (please pardon my C): char** extend_env(char** env, char* value) { int env_size = 0; while (env[env_size]) env_size++; char **new_env = malloc((env_size + 2) * sizeof(char*)); memcpy(new_env, env, env_size * sizeof(char*)); new_env[env_size++] = value; new_env[env_size++] = NULL; return new_env; } char *argv[] = {"/usr/bin/firefox", "https://example.com/", NULL}; char *default_env[] = {NULL}; char **env = default_env; bool should_free_env = FALSE; GdkDisplay *display = gdk_display_get_default(); if (display) { GdkAppLaunchContext* context = gdk_display_get_app_launch_context(display); env

Reference details

Source category
research-report
First reported
Feb 03, 2026 10:55 UTC
Last reported
Feb 03, 2026 10:55 UTC
Catalog updated
Oct 14, 2026 02:04 UTC
Record ID
5ca86577336d165ccff8d2ab02e98c07e228c9e11b522f990bfe395abe715f8e

Published indicators

Network indicators are visibly defanged. This page does not make them clickable or send them to another service.

No validated file hashes or network indicators are stored for this record.

Source observations

intelligence_src_ad89769b9e64591ab5

Source-provided label
Publisher RSS metadata
Evidence class
mentioned in report
Confidence
Not reported
Observed
Feb 03, 2026 10:55 UTC
Retrieved
Oct 14, 2026 02:04 UTC

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.

Review source update dates and status
  • intelligence_src_ad89769b9e64591ab5Recent successful batchLast successful batch: Last attempt:

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.