Windows, Linux, Android File Notification Systems Leak User Activity
Graz researchers show OS file-change notifications can reveal other users' activity without exposing file contents.
Researchers at Graz University of Technology found that file-change notification APIs in Linux, Windows, macOS, and Android let an unprivileged local process infer another user's activity from file names and event timing, without reading contents. Linux keystroke-timing detection scored 93.1–100% accuracy, Firefox font fingerprinting hit 87.9% on the top 100 sites, and Windows path disclosure identified Firefox sites at 97.8% across the top 1,000. The Linux kernel partially stopped device-file events under CVE-2025-68788; Microsoft said the Windows behavior is by design, no Android or macOS fixes were listed, and researchers reported no in-the-wild use. Proof-of-concept code is on GitHub.