You don’t always need to open someone’s files to find out what they’re doing. Sometimes, the operating system gives away enough clues on its own.
Researchers at Austria’s Graz University of Technology (via TU Graz) found that file-notification systems built into Windows, Linux, Android, and macOS let another account, or a rogue app designed by bad actors, track your activity without ever opening a single one of your files.
What exactly can someone see?
The underlying trick across all these platforms is surprisingly simple: an attacker only needs read access to a general parent folder to monitor file notifications for restricted subfolders and files inside it, bypassing read-access restrictions entirely.
On Windows, watching the C: drive from a second account flagged Firefox visits to the top 1,000 sites with a 97.8% F1 score, since Firefox names storage folders after the sites you visit. I’ve seen plenty of tracking claims fall apart under scrutiny; this one didn’t. On Linux, the same gap exposes keystroke timing (when you press each key, not which key you press), a technique used for decades to guess what you’re typing.
Even more alarming, on KDE Plasma, attackers can monitor the “polkit” interface (the system component that handles permission requests) to detect when the system asks for your password, seamlessly overlaying a fake entry window to steal your credentials. The trick works even over the secure Wayland protocol (the system that controls how apps display windows).
On Android, a zero-permission app could watch exactly when WhatsApp media arrived or vanished, filenames included. And while macOS locks down globally readable files better than the rest, its “FSEvents” API (a system that tracks file and folder changes) still leaks enough data to reliably track your daily behavior.
Is any of this getting fixed?
Only partly. Linux fixed the keystroke bug in December 2025 as CVE-2025-68788 (the official ID assigned to the security flaw). Windows has an optional fix, but it ships switched off by default, so attacks work out of the box. Android and macOS have no patch.
In my experience, that kind of gap lingers for years. For most of us on personal, single-user devices, the real-world risk is low, since every attack needs local access.
Shared computers, work laptops, and phones handed off for repair are where this actually matters. TU Graz alerted Linux, KDE, Android, Microsoft, and Apple before publishing; the paper heads to ACM CCS in the Netherlands this November.
File-notification side channels (hidden ways to infer activity from system signals) are an old, under-scrutinized corner of OS security, more academic curiosity than headline material until now. What makes this TU Graz paper notable is scope, not novelty: four unrelated operating systems, one shared architectural blind spot.
Expect slow, partial patching, since none of these vendors treat it as an urgent vulnerability.
