A file-notification feature built into every major operating system has been quietly leaking what users type and browse for decades, and most vendors are shrugging it off.
Researchers at Austria's Graz University of Technology found the flaw in the subsystems that tell apps when a file changes: inotify on Linux (vulnerable since 2005), FileObserver on Android (2008), ReadDirectoryChangesW on Windows (2000), and FSEvents on macOS (2007). Because unprivileged users can watch these notifications, the team showed they can time keystrokes, infer which websites someone visited, and in some cases attempt UI-redress attacks to steal login credentials. In one test, watching a Linux directory called /dev/input caught every keystroke and let them reconstruct typing with 93.1-100% accuracy across seven local users, and 100% accuracy over a remote SSH session. Vendors were notified about a year ago, and the researchers plan a demo at the ACM CCS 2026 conference.
The response so far is underwhelming. Linux shipped a partial patch, CVE-2025-68788, that blocks some of the leaky events but not the full attack. Microsoft calls the behavior "by design," despite the feature being undocumented, and doesn't consider it worth a fix. Apple acknowledged the report but hasn't announced one either.
Side-channel attacks are notoriously fiddly to pull off outside a lab, which probably explains the calm response. Still, decades-old and unpatched is not a great look for four operating systems at once.