Researchers at Graz University of Technology have uncovered decades-old flaws in the file-notification systems built into Android, Linux, macOS and Windows, exposing a cross-platform side channel that UK IT teams should treat as a live vulnerability management priority, not a curiosity.
View the data behind this chart
| Local keystroke | SSH keystroke | Website fingerprint | Windows tracking | |
|---|---|---|---|---|
| Accuracy | %93.1 | %100 | %87.9 | %97.8 |
What the researchers actually found
The team, led by doctoral student Sudheendra Raghav Neela alongside colleagues Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast and Daniel Gruss, examined the notification plumbing every modern operating system uses to tell applications when a file has been opened, changed, written or deleted: inotify on Linux (present since 2005), FileObserver on Android (2008), ReadDirectoryChangesW on Windows (2000), and FSEvents on macOS (2007).
None of these subsystems leak file contents directly. The problem is that the metadata they expose — which file, when, and what kind of event — is enough on its own to become a side channel. An unprivileged local user (and in some cases a remote one) can watch that metadata stream and infer what a completely different user or app is doing, without ever needing read access to the file itself.
How the leak turns into privilege escalation
The paper, titled 'File Notification Attacks', describes three practical exploit categories: inter-keystroke-timing attacks that reconstruct what a user is typing, website fingerprinting attacks that reveal browsing activity, and UI redress attacks that can be used to harvest credentials.
On Linux, watching a readable directory such as /dev/input generated a notification on every keystroke, which the team turned into a local timing attack with 93.1–100% accuracy across seven test users, and 100% accuracy when run remotely over SSH. On Windows, simply watching the root of C:\ reported the full path of every file touched anywhere on the system by any user, which the researchers used to track another user's Firefox browsing at 97.8% accuracy. A separate website-fingerprinting attack against the top 100 sites achieved 87.9% accuracy, and the team also demonstrated an authentication-prompt redress attack against KDE Plasma 6 running under Wayland.
For infrastructure teams, that is the crux of the risk: these are genuine privilege escalation and information-leak vectors that sit beneath the application layer, in a part of the OS most security tooling never inspects.
Patch status is wildly inconsistent across vendors
Disclosure was handled responsibly, with the researchers reporting findings to Linux, Android, Windows and macOS security teams between August and October 2025 — but the response since has been uneven, and that inconsistency is exactly what UK buyers need to plan around.
Linux received the most concrete fix: CVE-2025-68788 was partially patched in December 2025 across kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64 and 6.18.3, stopping access and modify events being generated on special files under /dev/. Android has had no mitigation at all, and Neela noted that FileObserver bypasses Android's per-app storage isolation entirely, letting a permissionless app watch a target folder — WhatsApp's, for instance — and infer exactly when photos, videos or documents are sent, received or deleted. Microsoft's response was to call the C:\ drive-wide monitoring behaviour 'by-design' and an undocumented feature, a stance nominated for the lamest vendor response at the Pwnie Awards 2026. Apple's macOS came off best: no bypass was found for reading private directories, though FSEvents still exposes plenty via .plist changes, including audio and Bluetooth settings, printer and network changes, application installs, and volume mount/unmount events.
Why UK buyers can't just wait for a patch
With Windows treating the behaviour as intentional and Android carrying no fix at all, most fleets running mixed estates will be exposed for the foreseeable future regardless of patch cadence. That makes this a policy and monitoring problem as much as a patching one.
Any file integrity monitoring or endpoint detection deployed as part of a wider cyber security programme should be reviewed against this class of attack specifically — not just whether files were changed, but whether the notification metadata itself is exposed to processes and users that have no business seeing it. Teams running shared multi-user Linux or Windows hosts, terminal servers, or BYOD Android estates handling sensitive comms apps are the most immediately exposed, and should treat directory-watch permissions as a live control gap until vendor mitigations mature.
Practical steps for infrastructure and security leads
- •Confirm Linux estates are running kernel 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3 or later — anything older remains exposed to CVE-2025-68788.
- •Review patch management processes to ensure kernel-level fixes like this one aren't deprioritised behind application patching.
- •Treat unpatched Windows and Android exposure as a permanent risk factor in architecture decisions, particularly for shared hosts and staff mobile devices running sensitive apps.
- •Extend zero trust principles to local process permissions, not just network access — this flaw exists precisely because unprivileged watchers were trusted by default.
- •Feed this attack class into managed detection and response playbooks, since standard EDR tooling was not built to flag notification-subsystem abuse.
- •For hardware or OS versions past vendor support that can't be upgraded quickly, review options under keeping end-of-support servers secure and consider third-party maintenance to bridge the gap safely.
What happens next
The full paper is scheduled to be presented at ACM CCS 2026 in The Hague this November, which will likely bring renewed pressure on Microsoft and Google to move beyond their current positions. Apple's low exposure profile doesn't mean macOS estates are risk-free, given the metadata leakage through FSEvents .plist changes still merits monitoring.
Until Android and Windows produce concrete fixes, UK buyers should assume this side channel is a permanent feature of their estate and build detection and access controls around it, rather than waiting for a single patch to close the door.