Windows, Linux, Android File Notification Systems Leak User Activity

Academics from Graz University of Technology have shown that the file-watching notification mechanisms present in Linux, Windows, macOS and Android can be exploited to spy on other local users, even by an app or account with no special privileges. By observing which files change and the timing of those changes, an attacker already running code on the same device can infer keystrokes, reconstruct which websites someone is browsing in Firefox, track WhatsApp media transfers, and even build a fake login prompt that steals credentials on KDE Plasma 6 under Wayland. The attacks don't read actual file contents, but patterns in filenames and timing proved enough to achieve high accuracy — over 93% for keystroke detection and up to 97.8% for identifying visited sites on Firefox. Only one of the flaws has been assigned a CVE, CVE-2025-68788, which Linux has partially patched by stopping input device files from triggering notification events; Microsoft considers the Windows behavior to be by design, and Apple and Google have yet to respond, while proof-of-concept code is already public on GitHub.