# Operating system file notification security vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/operating-system-file-notification-security-vulnerabilities
> Updated: 2026-09-28T00:00:00.000Z. Sources: 15. Developments: 2.

Security researchers at the Institute of Information Security at TU Graz have identified significant vulnerabilities within the file notification subsystems of Android, Linux, macOS, and Windows. These flaws, rooted in long-standing implementations, allow unprivileged users or malicious applications to monitor file-related events—such as when a file is opened, modified, or deleted—without requiring direct read access to the files themselves.

By utilizing these systems as a side channel, attackers can track filenames and the timing of file events to infer sensitive user activities. Specific demonstrations include using timing analysis of keystrokes to infer text on Linux, monitoring browser history through folder creation patterns on Windows, and observing activity within private app folders on Android via the FUSE layer. Researchers also noted the potential for UI redress attacks, such as creating fake password prompts in the KDE Plasma environment to intercept credentials.

While macOS was found to be the least susceptible, researchers noted that user behavior could still be tracked. The research team has informed the affected companies, and patches are already being developed for Linux.

## Timeline

### 2026-09-28: TU Graz researchers find security flaws in major operating systems

TU Graz researchers discovered that file notification systems in Windows, Linux, Android, and macOS can be exploited to track user activity, browsing history, and keystrokes via side-channel attacks.

11 sources. https://clstr.news/cluster/tu-graz-researchers-find-vulnerabilities-in-major-operating-system-file-notification-systems

### 2026-09-24: Security flaws found in Android, Linux, macOS, and Windows file systems

Researchers have discovered decades-old security flaws in the file notification systems of Android, Linux, macOS, and Windows that allow attackers to monitor user activity via side-channel leaks.

4 sources. https://clstr.news/cluster/security-flaws-found-in-android-linux-macos-and-windows-file-systems

---
Cite as: Operating system file notification security vulnerabilities. CLSTR, https://clstr.news/situations/operating-system-file-notification-security-vulnerabilities