File notifications turn out to be a leak channel on Linux, Android, Windows and macOS

Researchers from the Institute of Information Security at Graz University of Technology have shown that built-in file change notification systems themselves become a leak channel. They mean inotify in Linux, FileObserver in Android, ReadDirectoryChangesW in Windows and File System Events in macOS. An attacker only needs read permission on a file or directory, and that makes the problem common to all four platforms at once.

The contents of the files remain unknown in the process. Only the events themselves leak out: opening, modification, deletion. As the authors show, this is enough to reconstruct the behavior of the user, applications and the system. In some cases the observer even learns about files whose existence they could not have suspected before.

On Linux, watching a readable directory reports events involving the files inside it, even when those files are not directly accessible. Surveillance of /dev/input makes it possible to notice every keystroke and analyze typing rhythm, although the key pressed itself is not revealed. Similar logic works with /dev/pts: on a server with SSH, one user sees when another is typing.

A separate scenario in the paper concerns spoofing the authentication window in KDE Plasma on Wayland. The process watches for accesses to /usr/bin/pkexec and manages to draw a fake password prompt on top of the real one. The KDE team responded that its protection against focus stealing was never conceived as a security mechanism.

On Android, FileObserver bypasses the storage view that FUSE creates for each application. An ordinary application without permissions receives events in WhatsApp's private folder: for example, incoming media shows up as a MOVED_TO event with the file name. File names and creation times give away the type of attachment and add up into a timeline of sends and receives, while files laid out in separate Sent folders show what was sent and what was received.

Windows turned out to be the loudest case. Watching the root directory C: yields the full paths of all files accessed on the system, regardless of permissions and boundaries between users. The browser creates a separate directory for each site with local storage, and the directory name contains the domain. For Firefox, the authors recognize visits to sites from the top 1000 with an F1 score of about 97.8 percent. Microsoft called this behavior an undocumented feature, and the registry policy EnforceDirectoryChangeNotificationPermissionCheck, which closes it, is off by default.

macOS reveals the least: there, notifications concern only globally readable files, and private data does not leak. The problem in Linux was partially closed in December 2025 by disabling access and modification events for special files in /dev (CVE-2025-68788, kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65 and 6.18.3). For KDE, Android and macOS there are no fixes yet, and the attacks themselves require a local adversary or a compromised package in the supply chain. The authors put Microsoft's response forward for the Pwnies Award 2026 anti-award in the category for worst vendor response; the paper was accepted to ACM CCS 2026, and the conference will take place on 15-19 November in The Hague.

Legal status in Russia: Meta Platforms Inc.’s activities involving Facebook and Instagram have been designated extremist and prohibited in Russia. According to the Ministry of Justice list, the relevant court decisions do not apply to WhatsApp.

Translation editors: Соловьев В., Пеков А.