VulnerabilityPublished 25 Sep 2026

Windows, Linux, Android File Notification Systems Leak User Activity

Source SecurityWeek

Mentioned vulnerabilities

CVE-2025-68788

Severity

Medium

Rated by Threat Radar

Data as of 25 Sep 2026, 11:02 UTC

What to do

AI-suggested

Linux kernel has a partial fix (CVE-2025-68788) that disables device file event generation, mitigating the most severe issues. Microsoft considers the Windows behavior by design and recommends limiting local access to trusted users and keeping systems updated. Administrators can enable protections documented by Microsoft for certain directory change notification scenarios. No patches or mitigations are currently available for Android or macOS. Users should follow vendor guidance and restrict untrusted local code execution. No urgent patching is mandated as the issue requires local attacker presence and does not expose file contents.

Description

Researchers demonstrated that file-change notification systems in Windows, Linux, Android, and macOS can be exploited to leak user activity such as keystroke timing, browsing habits, and media events without elevated privileges. The attacks rely on monitoring file system events accessible to unprivileged users or apps, revealing metadata like file names and event timing rather than file contents. On Windows, monitoring the system drive root can expose file paths in other users' profiles, enabling website fingerprinting. Linux kernel mitigations partially address the most severe issues, but no patches exist for Android or macOS. Microsoft considers the behavior by design and not a vulnerability. No in-the-wild exploitation is known, and proof-of-concept code is publicly available.

Impact

The vulnerability allows an attacker with local code execution under a separate user account to monitor file system events and infer user activities such as keystroke timing, browsing history, and media file events without accessing file contents. This can lead to privacy breaches and credential harvesting via UI spoofing (demonstrated on KDE Plasma 6). The impact is limited to information disclosure of metadata and timing, not direct file content access. No remote exploitation or privilege escalation is indicated. The attack requires local presence and code execution under a different user context.

Summary

File-change notification features in major operating systems allow applications to receive alerts when files are created, modified, or deleted. Researchers at Graz University of Technology showed that these features can be abused by unprivileged users or apps to monitor other users on the same system. The attacks do not expose file contents but use file names and event timing to infer sensitive user activities such as keystroke timing (revealing typing rhythms), visited websites via browser data folders, and media events in apps like WhatsApp. On Linux, watching readable folders can leak events from protected files. On Windows, monitoring the root of the system drive reveals full paths of changed files across user profiles. The Linux kernel has been partially hardened (CVE-2025-68788) to reduce severity, but no fixes exist for Android or macOS. Microsoft states this behavior is by design and recommends standard security best practices. Researchers have not observed active exploitation in the wild but have published proof-of-concept code.

References

securityweek.com/windows-linux-android-file-notification-systems-leak-user-activity/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 25 Sep 2026, 11:02 UTC

References

Community reviews

Related threats