Keystroke detection accuracy across seven test typists: 93.1% to 100% (Source: Graz University of Technology research, via SecurityWeek (September 2026))
A permission nobody has to ask for
Researchers at Graz University of Technology in Austria have shown that file-change notification features built into Linux, Windows, macOS, and Android can be used to monitor other users on the same machine, from typing rhythm to which websites they visit. The capability exists so text editors, file managers, sync clients, and antivirus tools can react when files are created, modified, or deleted. It requires no elevated privileges, only read access to the location being watched. Most of the resulting attacks require an adversary who can already run code on the machine under a separate account; on Android, the researchers found an app requesting no permissions at all could carry it out.
Typing rhythm without the keys
On Linux, a user denied permission to watch a protected file can still receive its events by watching the folder that contains it, as long as that folder is readable. Applied to the device files representing keyboard input, this reveals when a key is pressed, though not which one. Combined with decades of prior research showing keystroke intervals can help infer content, the team tested the attack against seven typists.
Browsing history read from folder names
Firefox stores per-site data in folders named after the site itself, letting an unprivileged local user watch in real time which sites another account on the same machine is visiting. Edge showed far less exposure because it creates folders for a much smaller set of sites. The researchers also found that Firefox's font-loading behavior for a page could identify visited sites without needing folder names at all.
What's patched, what isn't
On Windows, the researchers describe a case where monitoring the root of the system drive causes Windows to report the full path of every file changed anywhere on the machine, including inside other users' home directories the monitoring account cannot itself read. Microsoft told the researchers this is by design, stating the technique requires an attacker who already has local code execution under a separate account and does not expose file contents. On Android, the team demonstrated that an app with no permissions could watch another app's private storage folder, revealing when WhatsApp media was sent, received, or deleted, along with file names. The Linux kernel has been partially hardened so device files no longer generate access and modify events, a fix tracked as CVE-2025-68788. The researchers list no fixes for Android or macOS, say they are not aware of in-the-wild exploitation, and have published proof-of-concept code on GitHub.
What a budget-holder should ask
This is a local, cross-account exposure rather than a remote breach path, which changes where it matters most: shared workstations, terminal servers, and multi-user Linux or Windows hosts. Security teams should be asked whether Linux fleets have applied the kernel hardening tracked as CVE-2025-68788 and on what timeline. On Windows and shared endpoints, ask whether local account isolation is enforced on any machine where multiple people log in under separate accounts, since the attacks assume that condition already exists. For KDE Plasma desktops running on Wayland, ask whether the fake-authentication-dialog scenario the researchers demonstrated has been tested against current builds. For mobile fleets, ask whether app review or MDM policy would catch an Android app that requests no permissions but still monitors another app's storage folder, as the researchers showed against WhatsApp.
