www.securityweek.com 25 Sept 2026, 10:53 UTC

Linux and Android File Notifications Expose User Activity Without Permissions

Linux and Android File Notifications Expose User Activity Without Permissions
CyberSIXT Evidence Panel Source marked as original reporting
CISA KEV Not in KEV
Patch Patch Status Unknown

RESEARCHERS at Graz University of Technology in Austria have demonstrated that file-change notification systems in Linux, Android, Windows and macOS can expose user activity without revealing file contents. Applications can monitor notifications about files being created, modified or deleted, generally without elevated privileges; most attacks require code running locally under a separate account, while on Android an app needs no permissions. File names and event timing can reveal activity such as typing patterns, websites visited, application launches and file transfers.

On Linux, monitoring a readable directory can reveal events from protected files, including keyboard device activity. Tests involving seven typists detected keystrokes with 93.1% to 100% accuracy, although hidden input such as a sudo password was not captured. Researchers also identified websites through Firefox font-loading activity with 87.9% accuracy and demonstrated a fake authentication prompt against KDE Plasma 6 on Wayland.

On Android, tests on Google Pixel and Samsung Galaxy devices showed that a permission-free app could monitor another app’s private storage; WhatsApp activity, including media transfers, filenames and deletions, was visible. Windows could disclose full paths of changed files across the system when the drive root was monitored, while Firefox website identification reached 97.8% accuracy across the top 1,000 sites, compared with 48.5% for Edge.

The Linux kernel has been partly hardened against the most serious device-file issues under CVE-2025-68788. Researchers listed no fixes for Android or macOS. Microsoft said the Windows behaviour is by design and pointed to protections administrators can enable for certain path-disclosure scenarios. No exploitation in the wild is known, and proof-of-concept code has been published.

View full article

Article by CyberSIXT