Windows, Linux, Android File Notification Systems Leak User Activity

Researchers found that file-change notification systems — built into Linux, Android, Windows, and macOS — can be abused by unprivileged processes to infer user activity such as keystrokes and browsing patterns through timing and file event metadata alone. The root cause is that these OS-level APIs were designed for developer convenience without sufficient access controls or privacy guardrails, meaning any installed application can silently observe behavioral signals. Microsoft's decision to treat this as 'by design' highlights a systemic gap where security and privacy implications of foundational OS features are underweighted during design. This matters because attackers or malicious apps can profile user behavior without triggering traditional privilege-escalation alerts, making detection extremely difficult.