Non-Snap Firefox does not connect to Flatpak KeePassXC unless AppArmor is disabled

[unilock]

Expected Behavior

The extension should be able to connect to KeePassXC without issue.

Current Behavior

"Key exchange was not successful." is shown instead.

Possible Solution

Disabling AppArmor completely works around the issue, but isn't ideal.

Steps to Reproduce (for bugs)

1. Install KDE neon (it seems to have AppArmor set up for Firefox out of the box)
2. Install KeePassXC as a Flatpak and set it up for Browser Integration with Firefox
3. Install KeePassXC-Browser and try to use it; it fails to connect to KeePassXC
4. Open a terminal and execute sudo aa-disable /etc/apparmor.d/usr.bin.firefox (may require the apparmor-utils package)
5. Try using KeePassXC-Browser again; it works

Debug info

KeePassXC-Browser: Connecting to native messaging host org.keepassxc.keepassxc_browser client.js:383:13
[Error ] KeePassXC-Browser - Failed to connect: Unknown error global.js:132:13
[Error ] KeePassXC-Browser - 9: Key exchange was not successful. global.js:132:13
[Error keepass.js:256] KeePassXC-Browser - 5: Cannot connect to KeePassXC. Check that browser integration is enabled in KeePassXC settings. global.js:132:13

<apparmor is disabled>

KeePassXC-Browser: Connecting to native messaging host org.keepassxc.keepassxc_browser client.js:383:13
KeePassXC-Browser: Server public key: [redacted] keepass.js:426:17
[Error ] KeePassXC-Browser - 1: Database not opened

KeePassXC - 2.7.7 (Flatpak)
KeePassXC-Browser - 1.9.0.3
Operating system: Linux (KDE neon / Ubuntu)
Browser: Firefox (not the Snap version)

Additionally, I tried what was recommended in the troubleshooting guide for AppArmor (link), but it made no difference. Even changing /usr/bin/keepassxc-proxy ixr, to /var/lib/flatpak/exports/bin/org.keepassxc.KeePassXC ixr, didn't help.

[varjolintu]

Do the paths differ in the guide compared to your system?

[unilock]

Do the paths differ in the guide compared to your system?

Which paths? I assume they don't, since the aa-disable command I mentioned leads to everything working fine with no other changes.

$HOME/.mozilla/native-messaging-hosts is correct.

/usr/bin/keepassxc-proxy does not exist, but I assume that's because I'm using the Flatpak version of KeePassXC. The file mentioned in the file KeePassXC generates in the native-messaging-hosts folder, /var/lib/flatpak/exports/bin/org.keepassxc.KeePassXC, does exist, but as I said, putting that in /etc/apparmor.d/usr.bin.firefox doesn't help.