What changed in 1.18.6 / 5.73.6
The project says that Sandboxie Plus 1.18.6 brings several fixes that improve stability and reliability, alongside expanded language support. The full changelog is short:
Added
- Persian (Farsi) translations. The release adds Persian (Farsi) translations for SandMan, the Troubleshooting Wizard, and the installer, thanks to imalyzer's contribution. Neowin's copy of the changelog lists the work as item #5633.
Fixed
- Broken SBIE message links in SandMan. The update fixes an issue in SandMan where URL-encoded characters were incorrectly interpreted as message placeholders, resulting in corrupted SBIE message links. SandMan is the Plus management app. SBIE messages are Sandboxie's numbered status and error codes, and they link to explanations. If a link broke, you couldn't easily look up what had gone wrong.
- Updater problems. The release also resolves updater issues to make the update process more reliable. The notes don't name specific error messages or update paths.
- Transient exemptions and path handling. Further corrections address transient exemption handling and path handling, improving reliability in these areas. The project gives no further detail. It doesn't say which paths or configurations were affected or what symptoms users would have seen, so we won't guess.
- Driver unload crash. A potential null pointer exception when unloading the driver has also been fixed, preventing a possible crash during driver shutdown.
Neowin's changelog spells it "transient excemption." The official GitHub release notes say "exemption," so treat it as a typo.
Summary: One translation addition and five fixes. The changes cover a link-display bug in SandMan, the updater, two reliability fixes the project doesn't describe in detail, and a possible crash when the driver unloads.
Is this a security update?
No. The release notes don't disclose a vulnerability, don't mention a CVE and don't claim any change to the security model. A MalwareTips forum post (written by the site's AI assistant, so read it as commentary rather than an official statement) reached the same conclusion. It called 1.18.6 a maintenance release rather than an emergency security update but said it was still worth installing for the updater, link-handling and driver fixes.
That's a reasonable view. There's no need to rush, but you shouldn't skip it either. The driver-unload fix touches kernel-mode code, and any isolation tool that runs a driver should be kept current. The updater fix also helps with every future release, not just this one.
Plus vs. Classic: same engine, different interfaces
New readers often wonder why Sandboxie ships two version numbers at once. The two editions have the same core components, this means they have the same level of security and compatibility. The difference is the interface. The Plus build has a modern Qt based UI which supports all new features that have been added since the project went open source. Classic keeps the old MFC interface.
The project's documentation says Classic lacks native interface support for Plus features. It adds that although some of the missing features can be configured manually in the Sandboxie.ini configuration file or even replaced with custom scripts, the Classic edition is not recommended for users who want to explore the latest security options.
For this release, that means:
- The shared fixes, including the driver-unload fix, presumably reach both editions because they share core components. The release notes don't list which fixes apply to which edition.
- The SandMan link fix applies to the Plus interface. SandMan is the Plus front end.
- The notes name SandMan, the Troubleshooting Wizard and the installer for the Farsi translation. They don't say whether Classic's interface gets it too.
If you're starting fresh, the project's own guidance points to Plus. Classic mainly suits people who want the old interface and don't mind editing an INI file.
How to update, and what to do if the update fails
For most people, the usual process is fine:
- Close every sandboxed program so no processes are still running inside a box.
- Run the updater or the new installer for your edition (Plus or Classic) and architecture.
- Check the version in the app afterward. Plus should report 1.18.6 and Classic 5.73.6.
If the upgrade fails, the release notes give one fix: the developer recommends uninstalling the previous build while retaining Sandboxie.ini, then installing the new version. Two points matter here:
- Keep
Sandboxie.ini. It holds all your sandbox definitions and settings. If you delete it, you'll be rebuilding your setup from memory. - Only use this step if a normal upgrade fails. The MalwareTips post says there's no need to perform that detour pre-emptively.
Another sensible precaution, from general practice rather than the release notes: back up Sandboxie.ini before any uninstall or reinstall. If you rely on Classic, keep a copy permanently, since your hand-written settings may exist nowhere else.
Where to get it, and a timing note
Neowin lists the 64-bit Plus installer at 23.8 MB and the 64-bit Classic installer at 3.0 MB, and links to an ARM64 build. Those sizes come from Neowin's listing; we haven't confirmed them on GitHub. The GitHub release page is the main source for the new build.
The project's own downloads page still listed the previous stable builds when checked: Sandboxie-Plus-x64-v1.18.5.exe (x64 Windows 7, 10, 11) Sandboxie-Plus-ARM64-v1.18.5.exe (ARM64 Windows 10, 11) Sandboxie-Classic Downloads Sandboxie-Classic-x64-v5.73.5.exe (x64 Windows 7, 10, 11). If you download from the website and get a 1.18.5 or 5.73.5 file, the page simply hadn't been updated yet, and you didn't make a mistake. You can get 1.18.6 from GitHub, or wait for the website to catch up.
The same page still offers older 32-bit builds, Sandboxie-Plus-x86-v1.15.12.exe (old 32-bit Windows 7, 10) and Classic 5.70.12. Those are frozen at older versions, so 32-bit users won't get any of the 1.18.6 fixes.
Release frequency
The 1.18 series has been updated often. According to the download site Uptodown, 1.18.4 Sep 7, 2026 … 1.18.3 Aug 31, 2026 … 1.18.2 Aug 17, 2026 … 1.18.1 Jul 26, 2026 … 1.18.0 Jul 12, 2026. Neowin covered 1.18.5 about two weeks before this release. That works out to roughly one update every two to three weeks since July.
That pace has two effects:
- Upside: Bugs get fixed quickly. A link bug and an updater problem were fixed within weeks rather than left for a big annual release.
- Downside: Frequent releases make the updater more important. That may explain why "fixed updater issues" is in this changelog, and why the project includes recovery instructions with its releases.
Admins who run Sandboxie on several machines should treat the 1.18 series like a browser: update regularly, check that the right version installed, and keep backups of the INI file.
A brief history
Sandboxie dates back to 2004, when it was initially released in 2004 as a tool for sandboxing Internet Explorer. Ronen Tzur wrote it. Invincea bought it, then Sophos bought Invincea, and the code was eventually open-sourced. David Xanatos has maintained it since. The project's README says it is an open-source OS-level virtualization solution for Microsoft Windows. Its stated purpose is to let programs run or install without permanently changing local or mapped drives or the registry.
Sandboxing reduces risk, but it doesn't make you immune to threats, and Sandboxie isn't a replacement for Microsoft Defender, regular Windows 11 updates or common sense. It's useful for testing unfamiliar software or containing a browser session. It doesn't protect you if you click a bad link outside the sandbox.
Summary: Sandboxie Plus 1.18.6 and Classic 5.73.6 add Farsi translations, fix SandMan's broken message links, improve the updater and fix a possible crash when the driver unloads. No security vulnerability is involved, but the update is still worth installing. If the upgrade fails, uninstall the old version, keep Sandboxie.ini and reinstall the new build. If the website still offers 1.18.5, get 1.18.6 from GitHub.