File Notification Systems Leak User Activity, Study Finds

A New Side Channel Hides in a Feature Most Users Never See

Security researchers report that file-change notification systems built into Windows, Linux, and Android can be used to infer sensitive details about what a person is typing, browsing, or messaging, without ever reading the contents of the files involved. According to the findings described by SecurityWeek on September 25, 2026, the leak comes from operating system mechanisms that exist to tell applications when a file on disk has been created, modified, or deleted.

These mechanisms have names most readers have never heard: inotify and fanotify on LinuxReadDirectoryChangesW and the NTFS USN Journal on Windows, and FileObserver on Android. Each lets a program register interest in a folder and receive a stream of events describing what changed there, without needing to open or read the files themselves. That design is normally harmless. It powers features like file sync clients, antivirus scanners, and search indexers. The researchers' point is that the timing and pattern of those change events, on their own, can reveal what a user is doing even when the observing process has no permission to see the actual data.

How Watching a Folder Can Reveal What You Type

The reported technique relies on the fact that many everyday actions produce predictable, repeated writes to disk. A text editor's autosave feature writes to a temp file with every few keystrokes. A browser writes to its cache and history database as pages load. A messaging app writes to a media folder when a photo or video is sent or received. Each of those writes triggers a file-change notification, and the researchers describe using the timing pattern of those notifications, rather than their content, to infer activity such as keystroke timing, browsing behavior, and WhatsApp media events.

This matters because it sidesteps the permissions most people think of as sensitive. An app does not need camera access, microphone access, screen-recording rights, or file-read permission on a target document to pick up this kind of signal. It only needs to be able to register for file-system change notifications, a capability that is often granted to ordinary applications, including sync tools, backup software, and some browser extensions, without raising a security prompt.

It is important to be precise about what has and has not been shown. This is a local, on-device side channel: the observing process has to already be running on the same device as the target, whether as an installed app, a browser extension, or another local process. The description provided does not indicate a remote attack, a patch timeline, or a CVE identifier, and it is not yet clear whether Microsoft, Google, or the maintainers of the Linux kernel have assigned tracking numbers or issued fixes. Readers should treat this as an early-stage research disclosure rather than an active, in-the-wild threat, and watch for follow-up advisories from those vendors.

What This Means For Your Business

For healthcare practices, tax professionals, and small businesses handling client data, the practical risk here is less about a single exploit and more about what it says about trust boundaries on endpoints. If a seemingly low-privilege app, an ad-supported utility, a browser extension, or a rogue sync tool can infer sensitive activity by watching file-system events, then the usual checklist of "does this app read my files or use my camera" is not a complete picture of risk.

Concrete steps worth taking now:

• Audit installed applications and browser extensions on staff devices, especially any with broad file-system access, and remove tools that are not clearly necessary for work.
• Apply least-privilege principles to endpoints by restricting local admin rights and using application allow-listing where practical, since this side channel requires code execution on the device to begin with.
• Keep endpoint detection and response (EDR) tooling active and review its ability to flag processes that register unusual file-system watch activity across sensitive directories like browser caches or messaging app media folders.
• Watch for vendor advisories from Microsoft, Google's Android security bulletins, and Linux distribution security teams over the coming weeks, since this disclosure may prompt mitigation guidance or patches that are not yet public.
• Treat this as a reminder for BYOD and remote-work policies: personal devices running unmanaged, low-scrutiny apps are the most likely place this kind of side channel could matter in practice.

None of this requires panic. The technique described depends on an attacker already having some form of code execution on the target device, which is the same precondition behind most malware-driven data theft. The takeaway is that reducing the number of untrusted apps and extensions running on work devices remains one of the highest-value security controls a small business or practice can maintain, and this research is one more reason it stays that way in 2026.