If a sandboxed app calls kill (0, signal) or killpg (0, signal), process ID namespace separation does not prevent the signal from being received by every process in the current process group, even though some of those processes are outside the process ID namespace.
https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2