Windows File Notifications Leak Browsing History at 97.8% Accuracy
Security / news
Windows File Notifications Leak Browsing History at 97.8% Accuracy
A Graz University of Technology team says the same class of bug exposes keystrokes on Linux and WhatsApp media on Android, and Microsoft calls its version an undocumented feature.
Watching Windows' root directory, C:\, for file-change notifications reveals the full path of every file touched anywhere on the system, by any user, with no special permission required. That is enough to identify which of the 1,000 most popular websites a Firefox user just visited with a 97.8 percent F1 score, according to a paper accepted to the ACM Conference on Computer and Communications Security (CCS), which runs Nov. 15 to 19 in The Hague.
Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast and Daniel Gruss, all at Graz University of Technology's Institute of Information Security, describe the finding in "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS." Neela, a doctoral student on the team, told The Register the team "found decades-old bugs... all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change."
Four notification systems, four different failures
The paper targets the mechanism every desktop and mobile OS uses to tell one program that another has touched a file, without content ever changing hands. Watching only the metadata still reveals what the file's name and timing say about the person who touched it.
| System | Shipping since | Worst demonstrated attack |
|---|---|---|
| ReadDirectoryChangesW (Windows) | 2000 | Website fingerprinting, 97.8% F1 on Firefox's top 1,000 sites |
| inotify (Linux) | 2005 | Inter-keystroke timing via /dev/input; fake password prompts via pkexec monitoring |
| FSEvents (macOS) | 2007 | Least exploitable of the four, the paper says |
| FileObserver (Android) | 2008 | WhatsApp media filenames and timestamps exposed despite no file-listing permission |
On Linux running KDE Plasma under Wayland, watching for access to /usr/bin/pkexec reveals the instant a real authentication prompt is about to appear, letting a local attacker draw a fake password dialog first. On Android, FileObserver bypasses the FUSE sandboxing meant to stop one app from listing another's files, exposing which WhatsApp media a victim sent or received and when.
One fix, one workaround, two nothings
The four vendors have responded on four different timelines since the team's responsible disclosure between August and October 2025.
Linux shipped the only unconditional fix, in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65 and 6.18.3 this past December, tracked as CVE-2025-68788. The patch stops the kernel from reporting access and modify events on character-special devices, closing the /dev/input keystroke-timing channel specifically, not the broader class of file-notification leakage elsewhere on the filesystem.
Microsoft added an opt-in registry policy, EnforceDirectoryChangeNotificationPermissionCheck, that is disabled by default, and told the researchers the behavior was "by-design" and an "undocumented feature," The Register reported. That response was nominated for lamest vendor response at the Pwnie Awards 2026. Apple and Google have shipped nothing: macOS leaks the least of the four systems tested, and Android, whose FileObserver bug breaks an isolation boundary the platform advertises, has had no update in the roughly eleven months since disclosure.
What would make this less alarming than it sounds
Every attack in the paper assumes the attacker already runs unprivileged code on the target machine; none of the four systems is exposed to a remote attacker over a network. That precondition matters differently depending on the machine. On a single-user Windows laptop, code already running locally can usually see plenty without this bug. On a shared Linux server, a university lab machine, or an Android phone where FileObserver defeats app-level sandboxing by design, the same precondition is one an operating system's own security model says should not be enough on its own.
It is the second time this month a paper has broken an assumption operating-system vendors treated as settled: a UC San Diego-led team forged RSA-1024 signatures via a raw signing oracle rather than factoring the key, at a fraction of the assumed cost. Radicle disclosed its own protocol-level flaw the same week, admitting its peer-to-peer network sends private repository data in plain text. The pattern across all three: the mechanism worked as designed, and the design's threat model was the part that was wrong.
The researchers plan to present the full findings at CCS in November; their write-up does not name any Android or macOS fix timeline, and Google and Apple have not said whether one is coming.
Sources
More in Security
- 01CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugMicrosoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.
- 02CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.
- 03OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.
- 04CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightThe worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.