File Notification Flaws Exposed User Activity
Researchers have identified widespread vulnerabilities in file monitoring systems that track user actions across all major operating systems.
Updated on Sept. 24, 2026 in Cybersecurity
Live Poll
Do you trust that your computer operating system keeps your background activity private from other users?
Security researchers at Graz University of Technology uncovered flaws in file notification subsystems across Linux, Android, Windows, and macOS that permit unauthorized tracking of user activity. These vulnerabilities allow unprivileged users to monitor file events to gain sensitive information about another user's habits.
Why it matters
The security gap stems from operating systems failing to properly restrict access to notification subsystems, which were designed to track file changes but can now be leveraged to reconstruct user behavior. This flaw highlights a fundamental conflict between system-wide monitoring utilities and user privacy boundaries.
Researchers achieved up to 100 percent keystroke accuracy in remote SSH attacks and 97.8 percent accuracy in real-time website tracking by exploiting file event notifications. These metrics represent a significant improvement over prior side-channel attacks by leveraging unfiltered access to system-level event logs.
The players
Graz University of Technology
An Austrian research institution specializing in computer science, cybersecurity, and applied mathematics.
Microsoft
The dominant developer of the Windows operating system and its associated system-level file notification APIs.
The details
The vulnerabilities exist because these operating systems allow unprivileged users to access file notification subsystems, such as Linux inotify or Windows ReadDirectoryChangesW, to receive updates on file modifications. Attackers monitor these event streams to perform inter-keystroke-timing analysis, website fingerprinting—the process of identifying websites visited by analyzing encrypted traffic patterns—and UI redress attacks. On Android, the FileObserver utility specifically bypasses storage isolation, granting access to monitor file activity in private folders.
Timeline
2000: The Windows ReadDirectoryChangesW subsystem was first introduced.
August-October 2025: Researchers disclosed their findings to affected security teams.
December 2025: A partial patch was released for the Linux kernel vulnerability CVE-2025-68788.
November 2026: The research paper is scheduled for presentation at ACM CCS 2026.
The Tech Race
This research follows the pattern set by the 2018 discovery of the Spectre and Meltdown side-channel vulnerabilities by demonstrating how standard, pervasive OS features can be weaponized. It exposes a persistent struggle in modern computing to isolate user-level actions from system-wide monitoring tools.
While Linux kernel CVE-2025-68788 has received a partial patch, users of other platforms currently lack documented fixes for these notification-based tracking methods. The most effective defense remains minimizing the number of untrusted applications with permission to access file system notifications.
The takeaway
These findings underscore the difficulty of securing OS subsystems that require broad visibility to function correctly. Readers should monitor future operating system security bulletins for official patches addressing file notification access controls.
What happens next
The findings are scheduled for a formal presentation at the ACM CCS 2026 conference in The Hague, Netherlands, in November 2026.
Further reading
For broader trends in vulnerability disclosure, visit our Cybersecurity section.
More information
View the complete technical breakdown on the research paper summary portal.
Live Poll
Do you trust that your computer operating system keeps your background activity private from other users?
