How File Notifications Let Unprivileged Apps Monitor Other Users

A file-change alert sounds less sensitive than the file itself. But researchers at Graz University of Technology showed that the names, paths, and timing of those alerts can give a local, unprivileged observer clues about what someone else is doing on the same device—even when the observer cannot read the files involved. Their research covers Linux, Android, Windows, and macOS. 620

The side channel: events without file contents

File-notification interfaces serve a legitimate purpose: they let software react when files are accessed or changed. Linux uses inotify; Android’s FileObserver uses inotify underneath; Windows offers ReadDirectoryChangesW; and macOS uses FSEvents. Reporting dates those interfaces to 2005, 2008, 2000, and 2007, respectively. Those dates describe the interfaces in the reporting, not a separately verified first-release history. 317

The distinction is between reading a file and learning that something happened to it. A notification does not disclose the file’s contents, but an event’s path, filename, type, or timing may still reveal activity. Android’s API documentation, for example, says FileObserver can report access or changes made by any process on the device. What an observer can learn depends on the interface and the location it can monitor; the finding does not mean every app can watch every file on every system. 1720

What the demonstrations showed

Linux: the rhythm of typing. A directory watch can expose inter-keystroke timing without granting read access to the files being watched. Reporting on the researchers’ local test gives a range of 93.1%–100% for detecting keystroke activity across seven users. That result concerns the timing of keystrokes; it should not be read as proof that the observer directly recovered the characters typed. 74

Windows: clues to browsing. In a Firefox website-fingerprinting demonstration, site-named directories provided a signal about which website another user visited. The reported result was a 97.8% F1 score among 1,000 websites. F1 is a classification measure, so calling that figure simply “97.8% accuracy” would change what was reported. 8

Android: media activity. Reporting on the research describes leakage of WhatsApp media events, while Android’s own documentation confirms that FileObserver reports events caused by other processes. The evidence here supports the risk of inferring activity from notifications, not a claim that the observer obtained the photos, videos, or documents themselves. 1017

macOS: the same class of exposure. The researchers identified file-notification metadata leakage on macOS as well. The available source excerpts establish the cross-platform finding but do not substantiate a comparably specific macOS experiment or performance figure. 620

Why the Linux fix is not a complete fix

The Linux issue tracked as CVE-2025-68788 concerns access or modification notifications for special files. An observer with access to a parent directory could receive events concerning a child device file it could not read. The kernel change prevents those particular ACCESS and MODIFY events from reaching parent-directory watchers; it does not eliminate every information leak through file notifications. 1112

The broader design lesson is that notification metadata can itself be sensitive. Checks on who may subscribe to an event need to account for what the event reveals, rather than assuming that withholding file contents is sufficient. The researchers’ paper is listed for ACM CCS 2026, scheduled for November 15–19 in The Hague. A June 2026 CISA assessment recorded “exploitation: none” for the Linux CVE; that assessment is not proof that no related side channel has ever been used in the wild. 61