Decades-old file security flaws found in Android, Linux, macOS and Windows

Security researchers at Graz University of Technology in Austria have found flaws in the file-notification subsystems of Android, Linux, macOS and Windows that leak what other users of a machine are doing.

What the researchers found

The subsystems tell applications when a file is opened, changed or deleted. They do not expose file contents, but the event stream acts as a side channel that lets an attacker without special privileges infer other users' activity. Affected are ReadDirectoryChangesW on Windows (2000), inotify on Linux (2005), FSEvents on macOS (2007) and FileObserver on Android (2008).

"We found decades-old bugs, all rooted in the file-notification subsystems that every modern OS ships," Sudheendra Raghav Neela, a doctoral student at TU Graz, told The Register.

Attack scenarios

With file-event data, an attacker can run inter-keystroke timing attacks that recover typed input, fingerprint visited websites or steal credentials through UI-redress tricks. On Linux, watching the readable /dev/input directory yields a notification on every keystroke; the team turned that into an attack with 93.1-100 percent accuracy across seven users and 100 percent over a remote SSH session. Fingerprinting reached 87.9 percent on the top 100 sites, and a redress attack on KDE Plasma 6's authentication prompt worked under Wayland.

On Android, FileObserver crosses the FUSE layer meant to isolate per-app storage, so a permissionless app can watch, for example, WhatsApp's private folder and tell from filenames when photos and documents are sent, received or deleted. On Windows, watching the root directory C:\ reports the full path of every file touched anywhere on the system, regardless of permissions - enough to track, at 97.8 percent accuracy, which sites another user visits in Firefox. macOS leaked the least: no bypasses for reading private directories were found.

Patches and responses

The Linux flaw, CVE-2025-68788, was partially fixed in December 2025 in six kernel branches, including 5.10.248, 6.6.120 and 6.18.3: the patch stops "access" and "modify" events for special files in /dev/. No Android fix has appeared. Microsoft called the Windows behaviour "by-design", a reply nominated for the lamest vendor response at the Pwnie Awards 2026.

The authors call for broader capability checks and a permission system in the Windows and macOS kernels. Their paper is due at ACM CCS 2026 in The Hague in November.