File-Notification APIs Leak User Activity Across Linux, Android, Windows, macOS

A study accepted at ACM CCS 2026 reveals that the file-change notification mechanisms built into Linux (inotify), Android (FileObserver), Windows (ReadDirectoryChangesW), and macOS (FSEvents) create a cross-platform side channel. An attacker with only read access can watch notifications—without ever seeing file contents—and reconstruct sensitive user and system behavior.

Each platform has its own severe variant: on Linux, watching a readable directory reports events on files inside it that the attacker cannot directly read, including /dev/input, enabling inter-keystroke timing attacks, and a related technique lets a same-user process watch pkexec accesses to spoof an authentication dialog on KDE Plasma/Wayland. On Android, FileObserver bypasses FUSE's per-app storage isolation, letting an unprivileged app monitor WhatsApp's private media folder and learn exactly when photos, videos, and documents are sent or received, complete with filenames. On Windows, watching the root of C:\ discloses the full path of every file touched anywhere on the system, across all users, which the researchers used to reveal in real time which websites another logged-in user was browsing.

Microsoft classifies the Windows behavior as an undocumented feature, a response that earned the vendor a nomination for the 'lamest vendor response' category at Pwnies Award 2026. The findings underline that file-monitoring APIs need permission checks aligned with the underlying filesystem, a gap that affects OS vendors and application developers building on these interfaces.