Researchers at Graz University of Technology have used the file-notification systems in Windows, Linux, and macOS to spy on activity in other accounts.
On Windows, a standard unprivileged account detected 95.7 percent of another user’s visits to popular websites in Firefox, and every site it flagged was one the victim’s browser had loaded. On Linux, a separate weakness exposed keystroke timing, both at the local keyboard and in SSH sessions.
Programs use these notifications to react when files change: a PDF viewer re-renders a document after a LaTeX recompile, and a sync tool copies an edited file to another machine. The researchers worked with Linux’s inotify, Windows’ ReadDirectoryChangesW, and macOS’s FSEvents, each of which an ordinary account can point at any directory it has permission to read. Their attacker runs code under a separate, unprivileged account on the victim’s machine. The paper cites compromised Linux services, which systemd often runs under their own users, as one route.
The method starts with mapping. The team performed everyday tasks while recording every file event on the system, then kept the files whose events tracked each task. Those templates covered terminal commands, keyboard and mouse input, browsing, printing, virtual machines and Docker containers, Bluetooth, network and VPN changes, and USB devices. Watching cost at most 0.21 percent of CPU time in their measurements.
An overview of the two phases of file-notification templating attacks: Templating and Attacking (Source: Research paper)
Windows hands over full paths
The researchers placed a watch on the root of the C: drive. Windows then reported file creations, modifications, and renames across the drive, with full paths, including inside other users’ home folders that were closed to the watching account.
Browsers save per-site data in folders whose names contain the site’s address. Firefox writes one when a site uses local storage, IndexedDB, or its cache; Edge, like other Chromium browsers, writes one for IndexedDB alone. Using an automated browser on Windows 11 24H2, the team loaded the top 1,000 sites, 975 of which responded. Firefox wrote a site-named folder for 95.7 percent of the tested sites and Edge for 32 percent. The watcher picked up each of those folders and made zero false matches in either browser. The paper attributes Edge’s lower detection rate to the smaller share of sites that use IndexedDB.
The drive-wide watch caught other traces too. Prefetch files carry the name of each program launched, ssh included. Zoom’s database files changed in distinct ways as a user entered a waiting room, joined a meeting, and left. A Windows Defender scan raised an event for each file it checked, handing the watcher the paths of other users’ documents, videos, and browser data. Defender appeared to skip unchanged files on later scans, so the paper ties that leak to the initial scan.
Microsoft told the team the behavior is by design and “only reveals file names and paths within another user’s profile directory.” In the browser test, names and paths were enough to rebuild a browsing history, and the authors argue Microsoft should reconsider.
Working separately, Sébastien Huneault reported similar behavior to Microsoft in April 2025 (CVE-2025-27738 and CVE-2025-21197); the Graz team says it learned of those reports long after submitting its paper. Microsoft’s update KB5058189 added a registry policy, EnforceDirectoryChangeNotificationPermissionCheck, which the paper says mitigates the behavior. Microsoft ships the policy disabled, and the authors report that every Windows attack in the paper works on an out-of-the-box system.
Linux leaks keystroke timing
On Linux, an account that can read a folder gets alerts for all the files in it, including files it is barred from opening. One of those is the keyboard’s device file, so each key press tells a watcher when a key went down and came up, not which key it was. Earlier studies have shown that this rhythm can help reconstruct typed text. On a test laptop, the attack caught nearly every keystroke from seven typists.
The same trick worked over SSH. In a test, a process on a server caught each of the 402 keystrokes a remote user typed, though it missed input typed into hidden password prompts such as sudo’s.
The team also showed that malware already running in a user’s account could draw a fake password window over a real one on the KDE desktop, and that the fonts Firefox loads can give away which of 100 popular sites someone has open.
Patches cover part of it
Team disclosed its findings to the Linux, Android, Windows, and macOS security teams between August and October 2025, and all four acknowledged them. Linux kernel developers shipped a partial mitigation in early 2026, and the findings were assigned CVE-2025-68788. The patch closes the unreadable-file route for device files; the rest of the file system remains exposed to it. The authors propose tying Linux watches to file ownership or read permission, and barring Windows from watching whole drives.
Other platforms
macOS showed the least leakage of the three desktop systems. The authors credit two factors: FSEvents limits reports to files the watcher can read, and it lacks the read-access events Linux provides. On macOS Sonoma 14.2.1, the researchers still saw printing, Bluetooth device changes, app installs and removals, and launches of specific apps such as Podcasts, Voice Memos, and Books.
On two Android 16 phones, a Pixel 9a and a Galaxy A54, a zero-permission app used Android’s FileObserver to see files that scoped storage is meant to keep from it. That exposed downloads, photos, and screenshots, along with WhatsApp’s private media folder. The app learned when received media arrived, read the file names, and saw when files were deleted. Earlier research had shown app launches leaking this way on Android.
The authors have published their code for all four platforms.