Other users can watch your browsing and time your keystrokes through OS file notifications

Researchers from Graz University of Technology showed that the file-change notification mechanisms built into Windows, Linux, macOS and Android can be abused by an unprivileged local account to spy on what another account is doing. By watching system calls like Windows' ReadDirectoryChangesW, Linux's inotify, and macOS's FSEvents, an attacker with no special rights could reconstruct a victim's browsing history, time their keystrokes, and even monitor app usage, VPN activity, or USB devices.

On Windows, simply watching the root of the C: drive revealed full file paths across every user profile, letting the team identify 95.7 percent of websites visited in Firefox with no false positives, by spotting the site-named folders browsers create for local storage and caching. On Linux, watching a directory exposed enough metadata about unreadable files—including the keyboard device file—to capture almost every keystroke typed locally or over SSH, even though the actual key values stayed hidden. Microsoft called the Windows behavior intentional, while Microsoft, Google, Apple and the Linux kernel team were all notified between August and October 2025.

The Linux kernel received a partial mitigation tracked as CVE-2025-68788, closing the gap for device files but leaving other unreadable files exposed. Microsoft previously added an opt-in registry setting (via update KB5058189) addressing related reports from another researcher, but it ships disabled, so the drive-wide watching attack still works on default installations. macOS and Android also leaked some information, though less severely, and the researchers have released proof-of-concept code for all four platforms.