Windows, Linux, Android File Notification Systems Leak User Activity
Graz researchers show OS file-change notifications can reveal other users' activity without exposing file contents.
Researchers at Graz University of Technology found that file-change notification APIs in Linux, Windows, macOS, and Android let an unprivileged local process infer another user's activity from file names and event timing, without reading contents. Linux keystroke-timing detection scored 93.1–100% accuracy, Firefox font fingerprinting hit 87.9% on the top 100 sites, and Windows path disclosure identified Firefox sites at 97.8% across the top 1,000. The Linux kernel partially stopped device-file events under CVE-2025-68788; Microsoft said the Windows behavior is by design, no Android or macOS fixes were listed, and researchers reported no in-the-wild use. Proof-of-concept code is on GitHub.
- Unprivileged local watchers infer activity from names and event timing.
- Linux keystroke timing scored 93.1% to 100%; Firefox fonts 87.9%.
- Windows drive-root watches leaked paths and Firefox sites at 97.8%.
- Permissionless Android apps exposed WhatsApp media names and timing.
- CVE-2025-68788 covers Linux devices; no known in-the-wild exploitation.
Vulnerabilities mentionedAll →
- CVE-2025-68788—<1%Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users…published · Linux kernel
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-68788 | Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users… In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent directory (e.g. /dev). Users with no read access to a file but with read access to its parent directory can still stat the file and see if it was accessed/modified via atime/mtime change. The same is not true for special files (e.g. /dev/null). Users will not generally observe atime/mtime changes when other users read/write to special files, only when someone sets atime/mtime via utimensat(). Align fsnotify events with this stat behavior and do not generate ACCESS/MODIFY events to parent watchers on read/write of special files. The events are still generated to parent watchers on utimensat(). This closes some side-channels that could be possibly used for information exfiltration [1]. [1] https://snee.la/pdf/pubs/file-notification-attacks.pdf |
Full article767 words · extracted from securityweek.com · click to collapse
Researchers at Graz University of Technology in Austria show that the file-change notification features built into Linux, Android, Windows, and macOS can be abused to monitor other users on the same system, from the rhythm of their typing to the websites they visit.
Linux, Windows, macOS, and Android let applications ask to be alerted when files are created, modified, or deleted. Text editors, file managers, sync clients, and antivirus products are among the programs that use this capability. It requires no elevated privileges, only read access to the location being watched.
The attacks never expose file contents, but the researchers demonstrated that file names and the timing of events are enough to reconstruct user, application, and system activity. Most of the attacks require an adversary who can already run code on the machine under a separate account. On Android, it would be an app that requests no permissions.
On Linux, a user who is denied permission to watch a protected file can still receive its events by watching the folder that contains it, as long as that folder is readable. Applied to the device files that represent keyboard input, this reveals when a user presses a key, though not which key.
Research going back more than two decades has shown that the intervals between keystrokes can help infer what is being typed. In tests with seven typists, the attack reliably detected keystrokes, scoring between 93.1% and 100% on a standard accuracy measure. Input that produces no on-screen text, such as a hidden sudo password, is not captured.
Other Linux attacks include website fingerprinting based on which system fonts Firefox loads for a page. This identified sites from the top 100 with an accuracy of 87.9%. The researchers also demonstrated a fake password prompt attack on the KDE Plasma 6 desktop running on Wayland. A malicious process running as the victim detects when the real authentication dialog is about to appear and draws a counterfeit over it to capture credentials.
Advertisement. Scroll to continue reading.
The researchers carried out their Android evaluations on a Google Pixel and Samsung Galaxy phones. They found that an app with no permissions can watch another app’s private storage folder.
In tests against WhatsApp, the technique revealed when photos, videos, and documents were received or sent, along with their file names. It also revealed when that media was later deleted.
The most serious Windows issue arises when a user monitors the root of the system drive. Windows then reports the full path of every file changed anywhere on the machine, including inside other users’ home directories that the monitoring account cannot read.
Firefox stores data for many websites in folders named after the site, so an unprivileged user can see in real time which sites another user is visiting. Across the top 1,000 websites, the researchers achieved 97.8% accuracy for Firefox and 48.5% for Edge, which creates folders for far fewer sites.
macOS leaks the least because only globally readable files can be monitored, but the researchers could still track application launches, app interactions, and settings changes.
No patches for most attack scenarios
The Linux kernel has been partially hardened so that device files no longer generate access and modify events, which the researchers say addresses the most severe issues. That fix is tracked as CVE-2025-68788. The researchers list no fixes for Android or macOS.
Microsoft told the researchers that the Windows behavior is by design, and that it reveals only file names and paths in another user’s profile directory, not file contents or sensitive data.
In a statement to SecurityWeek, a Microsoft spokesperson said:
“We thank the researcher for reporting this behavior. We investigated and determined that this is not a security vulnerability. The technique requires an attacker to already have the ability to run code locally on a device under a separate user account and does not provide access to file contents. Customers can help protect themselves by following security best practices, including limiting local access to trusted users, and keeping systems up to date.”
Microsoft also pointed to protections it documented in April 2025 for certain file-path disclosure scenarios involving directory change notifications, which administrators can enable.
Apple and Google have not responded to SecurityWeek’s request for comment.
The researchers say they are not aware of in-the-wild exploitation. Proof-of-concept code for the file notification attack has been published on GitHub.
Related: Old Attack, New Speed: Researchers Optimize Page Cache Exploits
Related: Researchers Demo New Claude Code Attack That Hijacks Developer Machines
Related: A Look at AI Doomsday Scenarios That Researchers Say Could Put Humanity at Risk