Windows, Linux, Android File Notification Systems Leak User Activity
Graz researchers show OS file-change notifications can reveal other users' activity without exposing file contents.
Researchers at Graz University of Technology found that file-change notification APIs in Linux, Windows, macOS, and Android let an unprivileged local process infer another user's activity from file names and event timing, without reading contents. Linux keystroke-timing detection scored 93.1–100% accuracy, Firefox font fingerprinting hit 87.9% on the top 100 sites, and Windows path disclosure identified Firefox sites at 97.8% across the top 1,000. The Linux kernel partially stopped device-file events under CVE-2025-68788; Microsoft said the Windows behavior is by design, no Android or macOS fixes were listed, and researchers reported no in-the-wild use. Proof-of-concept code is on GitHub.
- Unprivileged local watchers infer activity from names and event timing.
- Linux keystroke timing scored 93.1% to 100%; Firefox fonts 87.9%.
- Windows drive-root watches leaked paths and Firefox sites at 97.8%.
- Permissionless Android apps exposed WhatsApp media names and timing.
- CVE-2025-68788 covers Linux devices; no known in-the-wild exploitation.
- CVEs
- CVE-2025-68788
- Organizations
- Graz University of Technology
- Countries
- Austria
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-68788 | Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users… | — | <1% |
From the original article
3 min read at securityweek.com
Researchers show that file-change notification systems can leak keystroke timing, browsing activity, and WhatsApp media events. The post Windows, Linux, Android File Notification Systems Leak User Activity appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.