[REVISION HISTORY]
Operating system file notification security vulnerabilities
Updated 1 time since CLSTR started tracking revisions of this situation.
What changed
2026-09-28 09:02 UTC → 2026-09-29 07:13 UTC ·
added
removed
Security researchers at the Institute of Information Security at TU Graz have identified significant vulnerabilities within the file notification subsystems of Android, Linux, macOS, and Windows. These flaws, rooted in long-standing implementations, allow unprivileged users or malicious applications to monitor file-related events—such as when a file is opened, modified, or deleted—without requiring direct read access to the files themselves. By utilizing these systems as a side channel, attackers can track filenames and the timing of file events to infer sensitive user activities. Specific demonstrations of these vulnerabilities include using timing analysis of keystrokes to infer text on Linux, monitoring browser history through folder creation patterns on Windows, and observing activity within private app folders on Android via the FUSE layer. Researchers also noted the potential for UI redress attacks attacks, such as creating fake password prompts in the KDE Plasma environment to intercept credentials. While active exploitation in macOS was found to be the wild least susceptible, researchers noted that user behavior could still be tracked. The research team has not been confirmed, informed the research highlights how access to a parent directory can bypass protections on restricted subdirectories. affected companies, and patches are already being developed for Linux.
Versions
- 2026-09-29 07:13 UTC Operating system file notification security vulnerabilities
- 2026-09-28 09:02 UTC Operating system file notification security vulnerabilities
Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.