Overview
- Researchers at Graz University published their findings on Friday, Sept. 25, 2026, showing that built-in file-change notification systems in Linux, Windows, macOS and Android can be observed by unprivileged processes to track user activity.
- The attacks do not read file contents but use observable metadata—file and folder names, directory events and event timing—to reconstruct keystroke timing, app activity and visited sites in real time.
- Linux maintainers shipped a targeted hardening tracked as CVE-2025-68788 that prevents some device-file events, while Microsoft told researchers the Windows behavior is 'by design' and declined a patch; Apple and Google had not publicly committed fixes.
- The researchers published proof-of-concept code on GitHub and demonstrated high measurement accuracy in tests, including 93.1–100% keystroke-detection and 97.8% website fingerprinting for Firefox, yet they report no confirmed in-the-wild exploitation so far.
- The root cause is decades-old notification APIs that are widely used by editors and sync tools, which makes broad fixes hard and raises practical risk on multi-user systems and devices where many app or site files are globally readable.