File notifications in Windows, Linux and macOS let attackers spy on other users

Researchers at Graz University of Technology used file-notification systems in Windows, Linux and macOS to spy on activity in other accounts. On Windows an unprivileged account detected 95.7% of another user's Firefox site visits; on Linux it captured nearly every keystroke, including in SSH sessions. The flaws were assigned CVE-2025-68788 and received partial patches.

• On Windows an ordinary account detected 95.7% of sites visited in Firefox with zero false matches
• On Linux nearly all keystrokes were captured, including 402 keystrokes in an SSH session
• The attack consumed at most 0.21% of CPU time
• macOS leaked the least: FSEvents limits reports to files the watcher can read