Decades-old file security flaws found in Android, Linux, macOS, and Windows

Security researchers from Austria's Graz University of Technology discovered decades-old vulnerabilities in the file notification systems of four major operating systems: Android, Linux, macOS, and Windows. These flaws allow potentially compromising system information to be leaked, posing risks such as inter-keystroke-timing attacks, website fingerprinting, and UI redress attacks.

The file notification subsystems, which inform applications about file changes, have been present since 2005 on Linux, 2008 on Android, 2000 on Windows, and 2007 on macOS. These subsystems monitor file activities like opening, changing, writing, or deleting, but they do not disclose file contents. However, the side-channel information they provide can be exploited by malicious users to infer the actions of other users on the computer.

A local attacker with access to accounts containing readable files can launch these attacks. For instance, on Linux, watching a readable directory reveals events on files within it, even if the user cannot read them. This can be used for local inter-keystroke timing attacks with high accuracy and remote SSH attacks with perfect accuracy.

On Android, the FileObserver system, which extends beyond the FUSE layer for per-app storage isolation, allows a permissionless app to monitor file events like sending, receiving, or deleting files in specific directories.

The researchers claim that they responsibly disclosed their findings to security teams for Linux, Android, Windows, and macOS between August and October 2025. However, no mitigation has been implemented for Android devices. Apple's macOS showed the least information sharing, but FSEvents still enabled monitoring of various file changes, including power settings, Bluetooth device updates, network cable-initiated DNS changes, and volume mount/unmount events.

On Windows, watching the root directory C:\ reveals the full path of every file touched by any user, regardless of permissions, enabling real-time tracking of website visits. Microsoft responded that this is by-design and an undocumented feature, a claim contested by the researchers. The authors argue that file-notification attacks affect all major operating systems and recommend further mitigations, such as extending capability checks to monitoring one's own files and any readable file, or introducing a permission system for context access control in the kernel.

Their paper, titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS," is set to appear at ACM CCS 2026.