Researchers from Graz University of Technology, led by Sudheendra Raghav Neela and Daniel Gruss, identified a privacy vulnerability in file change notification subsystems across Android, Linux, macOS, and Windows. The findings are scheduled for presentation at the ACM CCS 2026 conference in The Hague this November.
The attack mechanism exploits systems that allow applications to subscribe to file creation, modification, or deletion events. By monitoring file names and timestamps, malicious software with local access can infer user activity, such as web browsing, file management, and communication patterns, even without direct access to file content.
On Linux, researchers monitored the /dev/input directory to track keystrokes with an accuracy ranging from 93.1% to 100% among seven test users. The Linux kernel has already received partial hardening against this method, identified as CVE-2025-68788, to restrict inotify events for specific files.
Windows systems are susceptible if a listener is placed in the root directory, allowing the OS to report full paths for every file change. Tests on Android devices, including Google Pixel and Samsung Galaxy models, showed that an application without special permissions could monitor WhatsApp media events to track the timing of file transfers.
