File-notification side channels leak activity on four operating systems

Graz researchers found file-notification APIs on Linux, Android, Windows, and macOS leak local activity such as keystrokes and visited websites.

Researchers at Graz University of Technology showed that long-standing file-notification APIs on Linux, Android, Windows, and macOS let an unprivileged local watcher infer user and application activity from file names and event timing without reading file contents. On Linux, an inotify watch on a readable parent such as /dev/input reported keystroke timing at 93.1–100% local accuracy and 100% over SSH, including events for files the watcher cannot read, and Firefox font fingerprinting hit 87.9% on the top 100 sites. Windows root watches using ReadDirectoryChangesW on C:\ disclosed full paths and tracked Firefox site visits at 97.8% across the top 1,000, including other users. Permissionless Android apps could time files inside WhatsApp's private folder and see media arrivals and deletions, and researchers demonstrated a KDE Plasma 6 Wayland prompt-redress attack in which watching pkexec let a same-user process overlay a fake password dialog. Linux CVE-2025-68788 was partly fixed in December 2025 by blocking access and modify events on device files; The Register said Android remained unmitigated, SecurityWeek said no Android or macOS fixes were listed, and researchers reported no in-the-wild use although proof-of-concept code is on GitHub. The Register and SecurityWeek say Microsoft called the Windows behavior by design, while the Lobsters report says Microsoft treated it as an undocumented feature; the work is slated for ACM CCS 2026.

• Graz University of Technology (TU Graz) reported side channels in Linux inotify (since 2005), Android FileObserver (since 2008), Windows ReadDirectoryChangesW (since 2000), and macOS FSEvents (since 2007) that let unprivileged local…
• Linux keystroke timing via /dev/input scored 93.1–100% locally and 100% over SSH; Firefox font fingerprinting reached 87.9% on the top 100 sites.
• Windows drive-root watches, including ReadDirectoryChangesW on C:\, exposed full paths and identified Firefox visits at 97.8% across the top 1,000 sites, including other users' activity.
• Permissionless Android FileObserver watches could timestamp files in WhatsApp's private folder and reveal media arrivals and deletions, bypassing per-app storage isolation.
• A KDE Plasma 6 Wayland prompt-redress demo used a pkexec watch so a same-user process could overlay a fake password dialog.
• CVE-2025-68788 partly limited Linux access and modify events on /dev files in December 2025; Android stayed unmitigated, no macOS fix was listed, no in-the-wild use was reported, and proof-of-concept code is on GitHub.
• The Register and SecurityWeek say Microsoft called the Windows behavior by design; a Lobsters summary says Microsoft treated it as an undocumented feature. The paper is scheduled for ACM CCS 2026.