File-Notification Attacks Expose Browsing Activity and Keystroke Timing Across Operating Systems
Summary
Graz University of Technology researchers found that file notifications can expose activity across user accounts on Windows, Linux, macOS, and Android, including browsing traces, keystroke timing, and device events. Mitigations are partial.
Key points
- On Windows, an unprivileged account could monitor drive-wide file notifications and identify site-specific traces; tests detected 95.7% of visited sites in Firefox and 32% in Edge.
- Linux inotify exposed keyboard timing, including all 402 keystrokes in one SSH test, but not the characters typed.
- Researchers also demonstrated leaks involving Windows application activity and scans, Linux browser activity, and macOS app launches, printing, and Bluetooth changes.
- On two Android 16 phones, a zero-permission app used FileObserver to observe downloads, photos, screenshots, and WhatsApp media activity.
- Linux shipped a partial mitigation for CVE-2025-68788 in early 2026; the fix closes the device-file route but leaves other file-system exposure.
- Microsoft’s KB5058189 added an optional registry policy that the researchers say mitigates Windows behavior; it is disabled by default.
Article Details
- Attack Vectors
- An unprivileged Windows account can monitor file notifications from the root of the C: drive and observe full paths, including paths in other users’ profiles. Site-named browser folders can reveal visited websites.
- On Linux, an account able to read a folder can receive notifications about files it cannot open, including keyboard-device events that expose keystroke timing. The researchers also demonstrated this against SSH input.
- On Android 16, a zero-permission app using FileObserver could observe downloads, photos, screenshots, and files in WhatsApp’s private media folder, including arrivals, names, and deletions.
- macOS FSEvents exposed some activity, including printing, Bluetooth changes, app installs and removals, and launches of specific apps.
- Defensive Notes
- Microsoft’s KB5058189 added the EnforceDirectoryChangeNotificationPermissionCheck registry policy. The paper says it mitigates the Windows behavior, but it ships disabled.
- Linux shipped a partial mitigation in early 2026 for notifications involving unreadable device files; the paper says other parts of the filesystem remain exposed.
- The researchers proposed tying Linux watches to file ownership or read permission and preventing Windows accounts from watching entire drives.
CVE
People
Vendors
Products
Androidat Graz University of Technology showed that file-notification systems in Windows, Linux, macOS, and Android can leak sensitive user activity across accounts, including browsing history, keystroke timing, andEdgeFirefox and Edge left detectable site-specific folder traces that exposed visited websites.KDEthat malware already running in a user’s account could draw a fake password window over a real one on the KDE desktop, and that the fonts Firefox loads can give away which of 100 popular sites someone has open.LinuxResearchers at Graz University of Technology showed that file-notification systems in Windows, Linux, macOS, and Android can leak sensitive user activity across accounts, including browsing history, keystroke timing,macOSResearchers at Graz University of Technology showed that file-notification systems in Windows, Linux, macOS, and Android can leak sensitive user activity across accounts, including browsing history, keystroke timing,Microsoft WindowsResearchers at Graz University of Technology showed that file-notification systems in Windows, Linux, macOS, and Android can leak sensitive user activity across accounts, including browsing history, keystroke timing,Mozilla FirefoxFirefox and Edge left detectable site-specific folder traces that exposed visited websites.WhatsAppAndroid FileObserver allowed a zero-permission app to see downloads, photos, screenshots, and WhatsApp media.Windows DefenderA Windows Defender scan raised an event for each file it checked, handing the watcher the paths of other users’ documents, videos, and browser data.ZoomZoom’s database files changed in distinct ways as a user entered a waiting room, joined a meeting, and left.