Researchers expose long-standing file-notification vulnerabilities across major operating systems
Security researchers from Graz University of Technology identified decades-old flaws in file-notification mechanisms on Android, Linux, macOS and Windows that can leak system activity data.
A group of researchers at Graz University of Technology reported that core file-notification services on Android, Linux, macOS and Windows contain vulnerabilities dating back to the early 2000s. These services— inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows and FSEvents on macOS— expose metadata about file operations to any unprivileged user, creating a side-channel that can be weaponized.
Demonstrations included high-accuracy keystroke timing attacks, website fingerprinting and UI redress attacks that could capture credentials. The Linux flaw (CVE-2025-68788) was partially addressed in kernel updates released in December 2025, but Android and Windows have seen no comparable fixes. macOS exhibited the least risk, lacking directory-reading bypasses yet still leaking events such as audio device changes and application installs. The researchers call for broader capability checks and permission controls to mitigate these cross-platform threats.
Why it matters
These flaws let attackers infer user activity across major OSes, posing privacy and security risks for millions of devices.
In this story
