RESEARCHERS at Graz University of Technology in Austria have demonstrated that file-change notification systems in Linux, Android, Windows and macOS can expose user activity without revealing file contents. Applications can monitor notifications about files being created, modified or deleted, generally without elevated privileges; most attacks require code running locally under a separate account, while on Android an app needs no permissions. File names and event timing can reveal activity such as typing patterns, websites visited, application launches and file transfers.
On Linux, monitoring a readable directory can reveal events from protected files, including keyboard device activity. Tests involving seven typists detected keystrokes with 93.1% to 100% accuracy, although hidden input such as a sudo password was not captured. Researchers also identified websites through Firefox font-loading activity with 87.9% accuracy and demonstrated a fake authentication prompt against KDE Plasma 6 on Wayland.
On Android, tests on Google Pixel and Samsung Galaxy devices showed that a permission-free app could monitor another app’s private storage; WhatsApp activity, including media transfers, filenames and deletions, was visible. Windows could disclose full paths of changed files across the system when the drive root was monitored, while Firefox website identification reached 97.8% accuracy across the top 1,000 sites, compared with 48.5% for Edge.
The Linux kernel has been partly hardened against the most serious device-file issues under CVE-2025-68788. Researchers listed no fixes for Android or macOS. Microsoft said the Windows behaviour is by design and pointed to protections administrators can enable for certain path-disclosure scenarios. No exploitation in the wild is known, and proof-of-concept code has been published.