Particle.news

File-Notification APIs Let Low-Privilege Processes Infer Keystrokes and Website Visits

With public proof-of-concept code and a limited Linux kernel hardening, most vendors have not issued broad fixes.

Overview

  • Researchers at Graz University published their findings on Friday, Sept. 25, 2026, showing that built-in file-change notification systems in Linux, Windows, macOS and Android can be observed by unprivileged processes to track user activity.
  • The attacks do not read file contents but use observable metadata—file and folder names, directory events and event timing—to reconstruct keystroke timing, app activity and visited sites in real time.
  • Linux maintainers shipped a targeted hardening tracked as CVE-2025-68788 that prevents some device-file events, while Microsoft told researchers the Windows behavior is 'by design' and declined a patch; Apple and Google had not publicly committed fixes.
  • The researchers published proof-of-concept code on GitHub and demonstrated high measurement accuracy in tests, including 93.1–100% keystroke-detection and 97.8% website fingerprinting for Firefox, yet they report no confirmed in-the-wild exploitation so far.
  • The root cause is decades-old notification APIs that are widely used by editors and sync tools, which makes broad fixes hard and raises practical risk on multi-user systems and devices where many app or site files are globally readable.