Other users can watch your browsing and time your keystrokes through OS file notifications

1. Executive summary

Researchers at Graz University of Technology have shown that the file-notification subsystems shipped by Linux, Windows, macOS and Android leak activity from other local accounts to any unprivileged process, and have published the technique under the name file-notification templating. On Windows, a standard account watching the root of C: reconstructed another user's Firefox browsing history at 95.7 percent accuracy with zero false matches; on Linux, watching /dev/input yielded inter-keystroke timing at 93.1 to 100 percent accuracy locally and 100 percent over SSH. The Linux flaw is tracked as CVE-2025-68788, has no CVSS score in NVD, is not in CISA KEV, and carries an EPSS of 0 percent, so it is not being exploited at scale today; the risk is a local attacker or a compromised service account on a shared host, not a remote unauthenticated attacker. For EMEA financial services the exposure is concentrated in multi-tenant jump hosts, build and CI runners, VDI and Citrix estates, and any Linux server where a low-privileged service account shares a host with privileged operators. The Linux kernel fix is partial and shipped in December 2025; the Windows mitigation exists but Microsoft ships it disabled, so out-of-the-box Windows remains exploitable.

2. Regulatory framing

No DORA incident-reporting article is engaged on the facts available: there is no evidence of a live incident at a client, and CVE-2025-68788 is not in CISA KEV. If a client confirms exploitation, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become live at that point, not before.

3. Technical analysis & attack chain

The research covers four operating systems and four notification subsystems: inotify on Linux (present since 2005), FileObserver on Android (2008), ReadDirectoryChangesW on Windows (2000) and FSEvents on macOS (2007). The common defect is that an unprivileged account can register a watch on any directory it can read, and on Linux and Windows the resulting events are delivered for files inside that directory even when the watching account cannot read the files themselves. The events carry file names and paths, not file contents. The leak is the metadata.

Confirmed steps, as described in the paper and the reporting:

1. The attacker obtains code execution under a separate, unprivileged account on the victim's machine. The paper names compromised Linux services, which systemd commonly runs under their own dedicated users, as one route to that position.
2. The attacker registers a file watch. On Windows the watch is placed on the root of C:\. On Linux the attacker watches a directory it can read, for example /dev/input.
3. The notification subsystem delivers events for activity across the whole watched tree, including activity belonging to other users and files the watching account has no read permission on.
4. The attacker records events while performing known tasks, then keeps the files whose event patterns track each task. The paper calls these templates. Templates were built for terminal commands, keyboard and mouse input, browsing, printing, virtual machines and Docker containers, Bluetooth, network and VPN changes, and USB devices.
5. At attack time the attacker matches live events against the templates to infer what the victim is doing.

Measured results, per the paper as reported:

• Windows, Firefox: a watch on C:\ reported the full path of every file touched anywhere on the system, across all users, regardless of permissions. Against the top 1,000 sites (975 responded) on Windows 11 24H2, Firefox wrote a site-named folder for 95.7 percent of tested sites and the watcher detected 95.7 percent of the victim's visits with zero false matches. Edge was detected for 32 percent of sites, which the paper attributes to fewer sites using IndexedDB. Firefox writes a site-named folder when a site uses local storage, IndexedDB or its cache; Chromium browsers write one for IndexedDB alone.
• Windows, other traces: Prefetch files carry the name of each launched program, ssh included. Zoom database files changed in distinguishable ways as a user entered a waiting room, joined a meeting and left. A Windows Defender scan raised an event for every file it checked, exposing paths of other users' documents, videos and browser data; Defender appeared to skip unchanged files on later scans, so the paper ties that leak to the initial scan.
• Linux, keystroke timing: watching /dev/input produces a notification on every keystroke. The team reports 93.1 to 100 percent keystroke accuracy across seven users locally, and 100 percent over SSH.
• Linux, website fingerprinting: 87.9 percent against the top 100 sites.
• Linux, UI redress: an authentication-prompt redress attack on KDE Plasma 6 under Wayland.
• Android: FileObserver reaches past the FUSE layer intended to isolate per-app storage, so an app holding no relevant permission can watch another app's private folder and see, by filename and timestamp, when photos, videos and documents are sent, received or deleted. The example given is WhatsApp's private folder.
• macOS: no bypasses were found for reading private directories, so macOS leaked the least. FSEvents still exposed changes visible in .plist files, including audio input and output changes, power settings changes, Bluetooth device and printer updates, network cable-initiated DNS changes, and volume mount and unmount events. Application installations and removals were also observable.
• Cost: watching consumed at most 0.21 percent of CPU time in the team's measurements.

Remediation state, which is the part that matters operationally:

• Linux: CVE-2025-68788 was partially fixed in December 2025 in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64 and 6.18.3. The patch stops the generation of "access" and "modify" events on special files in /dev/. It is a partial fix: it addresses the /dev/input keystroke path, not the general property that a readable directory leaks events for unreadable files inside it.
• Windows: Microsoft's position is that the behaviour is by design and "only reveals file names and paths within another user's profile directory." Update KB5058189 added a registry policy, EnforceDirectoryChangeNotificationPermissionCheck, which the paper says mitigates the behaviour. Microsoft ships the policy disabled, and the authors state that every Windows attack in the paper works on an out-of-the-box system.
• Android: no mitigation appears to have been made.
• macOS: no bypasses found for private directory reads.

Confidence and provenance. The technical findings, the accuracy figures, the kernel versions, the registry policy name and the vendor responses all come from the Graz University of Technology paper and its authors as relayed by Help Net Security and The Register. The two outlets are reporting the same underlying paper, so this is one research effort, not independent corroboration. The Register notes that Sébastien Huneault separately reported similar Windows behaviour to Microsoft in April 2025 under CVE-2025-27738 and CVE-2025-21197, and that the Graz team learned of those reports after submitting its paper; the two efforts are independent but the Graz results are not independently reproduced by a third party in the material available. No exploitation in the wild is reported by any source, which is consistent with the EPSS score of 0 percent. Treat the accuracy percentages as the researchers' own measurements on their own test rigs.

Discrepancy note. The primary item's headline figure for Windows Firefox detection is 95.7 percent; The Register quotes 97.8 percent for the same scenario. Both figures appear in the source material and the difference is not explained there. Use 95.7 percent, which is the figure in the fuller Help Net Security account and the one tied to the top-1,000-site test.

4. Mitigation & containment

The threat model is a local unprivileged account or a compromised service account on a shared host. Mitigations that assume a remote attacker do not apply.

P1, within 24 hours:

• Inventory shared Linux hosts where more than one human or service account can run code: jump and bastion hosts, CI runners, build agents, VDI and Citrix back ends, and any server where a service account and an operator session coexist. These are the assets where CVE-2025-68788 is reachable.
• On those hosts, check the running kernel against the fixed releases: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3. uname -r gives the running version. Hosts below these point releases have the /dev/input keystroke leak open.
• On Windows estates, deploy the registry policy EnforceDirectoryChangeNotificationPermissionCheck from KB5058189. It ships disabled, so its presence in the update is not mitigation. Confirm the policy value is set, not merely that the KB is installed.
• Restrict who can hold an interactive session on a host that also runs services. Where a service account is compromised, the paper's own route, the attacker inherits that account's directory reads.

P2, within 72 hours:

• Reduce the readable surface. The paper's point is that the list of globally readable files is extensive; audit world-readable directories on shared Linux hosts and remove read permission where it is not required. Watching a directory leaks events for files inside it that the watcher cannot read, so tightening directory read permissions is the control, not tightening file permissions.
• On Linux hosts that cannot be patched immediately, restrict read access to /dev/input to the accounts that need it (typically the display manager and input-handling services) and confirm no service account retains it.
• Treat the Windows finding as a data-exposure issue for browser profiles. A drive-wide watch on C:\ reconstructs browsing history from site-named folders under other users' profiles. Where Windows hosts are shared between accounts, separate them or accept that browsing history is visible to any local account.
• For Android, no vendor mitigation exists. If managed Android devices hold sensitive messaging data and run third-party apps, treat per-app storage as observable by other installed apps and adjust what is permitted on those devices.

P3, within 7 days:

• Add detection for the behaviour itself rather than for the CVE (see §6). A process registering a recursive watch on C:\ or on /dev/input is unusual and worth alerting on.
• Review whether the Windows Defender scan leak matters in your environment: the initial scan exposes paths of other users' documents, videos and browser data to any watcher. If shared Windows hosts are in scope, this is a reason to schedule scans outside periods when other accounts are active, or to accept the exposure.
• Track the Linux fix forward. The December 2025 patch is partial and addresses special files in /dev/ only. Later kernel releases may extend it; the general readable-directory leak is not fixed by it.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. There are no hashes, domains, IP addresses or file paths belonging to an attacker in the sources; the research describes a technique, not a campaign, and no in-the-wild exploitation is reported.

The sources do describe observable behaviours. These are listed below and are not placed in the copyable block, which is reserved for machine-pivotable atomic indicators.

Behavioural indicators

6. Detection

The sources give usable artefacts for a behavioural rule: the specific directories watched (C:\, /dev/input), the API and subsystem names (ReadDirectoryChangesW, inotify, FSEvents, FileObserver), the registry policy name, and the kernel versions. The registry policy name and the subsystem names are genuine artefacts of the technique and the mitigation, so they are usable. CVE identifiers are not threat artefacts and are not used as rule strings.

rule File_Notification_Watch_Abuse_Strings
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-28"
        reference = "https://www.helpnetsecurity.com/2026/09/28/cve-2025-68788-file-notification-attacks/"
        description = "Strings associated with file-notification side-channel tooling and the Windows mitigation policy named in the Graz University of Technology research"
    strings:
        $api_win = "ReadDirectoryChangesW" ascii wide
        $api_linux = "inotify" ascii wide
        $api_mac = "FSEvents" ascii wide
        $api_android = "FileObserver" ascii wide
        $policy = "EnforceDirectoryChangeNotificationPermissionCheck" ascii wide
        $dev_input = "/dev/input" ascii wide
        $root = "C:\\" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

This rule is a triage aid, not a detector for the attack itself. The strings are generic API and path names that legitimate software also contains, so expect false positives on backup agents, sync clients, endpoint agents and anything that watches the filesystem. Use it to prioritise review of binaries that reference the Windows mitigation policy or combine a watch API with /dev/input, not to block on.

title: File watch registered on sensitive directory by non-system account
id: 8f2c1a44-6b7e-4d19-9c3a-0a5e7d2b91f0
status: experimental
description: Detects a process registering a file watch on C:\ or /dev/input, the two watch targets named in the Graz University of Technology file-notification research
author: Adverse Trace
date: 2026-09-28
references:

    - https://www.helpnetsecurity.com/2026/09/28/cve-2025-68788-file-notification-attacks/
    - https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/5298672
logsource:
    product: linux
    service: auditd
detection:
    selection_path:
        type: 'PATH'
        name:

            - '/dev/input'
    selection_watch:
        syscall: 'inotify_add_watch'
    condition: selection_watch and selection_path
falsepositives:

    - Display managers and input-handling services that legitimately read /dev/input
    - Endpoint agents and backup software that watch broad directory trees
level: medium

For Windows, the equivalent detection is a process registering a recursive watch on C:\ where the process owner is not SYSTEM and not a known endpoint agent. The sources do not provide a field-level event schema for this, so no Windows Sigma rule is written rather than inventing field names.

CVE assessment

1 referenced CVE

7. Sources

• Help Net Security, "Other users can watch your browsing and time your keystrokes through OS file notifications", 2026-09-28. https://www.helpnetsecurity.com/2026/09/28/cve-2025-68788-file-notification-attacks/
• The Register, "Decades-old file security flaws found in Android, Linux, macOS, and Windows", 2026-09-24. https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/5298672
• Graz University of Technology, paper "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS", authors Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast and Daniel Gruss, summarised at inoti.fyi. Cited via the two reports above; the paper itself was not fetched for this advisory.

8. Adverse Trace position

We assess CVE-2025-68788 as a low-urgency, high-impact-if-reachable local information-disclosure issue, not a remote compromise path. The verified data supports that: no CVSS score is assigned in NVD, the CVE is not in CISA KEV, and EPSS is 0 percent, so there is no evidence of exploitation and no basis for treating this as an emergency patch. The impact is real where the preconditions hold, which is any host where an unprivileged account or a compromised service account shares the machine with a privileged operator, and the Linux keystroke-timing result over SSH is the finding that should drive action for clients running shared jump hosts. The Windows position is worse than the Linux one in practice because the mitigation exists and is shipped disabled, so a fully patched Windows estate is still exposed until someone sets the policy. We will track kernel releases beyond the December 2025 point releases for an extension of the partial /dev/ fix, watch for any change to the CISA KEV or EPSS status, and re-issue this advisory if exploitation is reported or if Microsoft changes the default for EnforceDirectoryChangeNotificationPermissionCheck. Clients who want a targeted review of shared-host exposure should contact their Adverse Trace handler.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.