- Graz University of Technology researchers found that file-change notifications on Windows, Linux and Android let one account infer another's typing timing and browsing history. Most attacks need a foothold on the machine first.
- Linux has a kernel fix (CVE-2025-68788). Microsoft closed the report without a fix, calling it intentional, and Android and macOS have no fix yet. The researchers have seen no use outside their lab.
- Ask security teams whether Linux fleets have the kernel fix, whether shared Windows machines enforce account isolation, and whether mobile app policy would catch a no-permission Android app watching another app's storage.
A monitoring hook nobody has to unlock
Every major operating system ships a mechanism that lets software ask to be told the moment a file is created, changed, or deleted — the plumbing behind sync tools, antivirus scanners, and file managers that need to react instantly. A team at Graz University of Technology in Austria found that the same signal can be turned around: an account on a shared machine can watch another account's activity through it, inferring typing rhythm and browsing habits without ever opening a protected file. The only requirement is read access to the folder being watched, not any special privilege. In nearly every case the researchers built, the attacker still needed a foothold first — a separate account already able to run code on the same machine. Android is the exception: the researchers showed an app requesting zero permissions could still pull this off.
Typing rhythm without the keys
On Linux, watching a sensitive file directly can be blocked — but the researchers found that watching the directory holding that file often isn't, and it emits the same change events. Pointed at the device files that register keyboard input, this trick reveals the instant a key is pressed, just not which one. Paired with older research on how keystroke timing alone can hint at content, the team tested the approach on seven typists.
Browsing history read from folder names
Firefox stores per-site data in folders named after the site itself, letting an unprivileged local user watch in real time which sites another account on the same machine is visiting. Edge showed far less exposure because it creates folders for a much smaller set of sites. The researchers also found that Firefox's font-loading behavior for a page could identify visited sites without needing folder names at all.
What's patched, what isn't
Windows has its own version of the problem, at a wider scope. Point the notification feature at the root of the system drive, and the researchers found Windows will hand back the full path of every changed file anywhere on the machine — including inside other users' home directories that the watching account has no rights to open directly. Microsoft reviewed the report and closed it without a fix, calling the behavior intentional: exploiting it still requires an attacker who already has local code execution under a separate account, and it exposes file paths, not contents. On Android, the team's tests against WhatsApp showed the no-permission app trick revealing when media was sent, received, or deleted, along with file names. Linux is the one platform with a fix already in hand: a kernel change logged as CVE-2025-68788 stops device files from generating access and modify events, closing what the researchers flagged as the most severe of the issues they found. Android and macOS have no equivalent fix yet. The researchers say they have seen no sign the technique has been used outside their own lab, and they have posted proof-of-concept code publicly on GitHub.
What a budget-holder should ask
This is a local, cross-account exposure rather than a remote breach path, which changes where it matters most: shared workstations, terminal servers, and multi-user Linux or Windows hosts. Security teams should be asked whether Linux fleets have applied the kernel hardening tracked as CVE-2025-68788 and on what timeline. On Windows and shared endpoints, ask whether local account isolation is enforced on any machine where multiple people log in under separate accounts, since the attacks assume that condition already exists. For KDE Plasma desktops running on Wayland, ask whether the fake-authentication-dialog scenario the researchers demonstrated has been tested against current builds. For mobile fleets, ask whether app review or MDM policy would catch an Android app that requests no permissions but still monitors another app's storage folder, as the researchers showed against WhatsApp.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SecurityWeek.
