Decades-old file security flaws found in Android, Linux, macOS, and Windows

Researchers disclosed decades-old file-notification side-channel flaws across Linux, Android, Windows and macOS that can expose user activity, including keystrokes, website visits and credential-related interactions. Demonstrated attacks achieved 93.1%-100% keystroke accuracy on Linux, 87.9% website-fingerprinting accuracy on the top 100 sites, and 97.8% Firefox browsing-tracking accuracy on Windows. Linux partially patched CVE-2025-68788 in December 2025, but Android reportedly has no mitigation, while Microsoft considers its broad drive-monitoring behavior to be by design.

Analysis

The asymmetric equity exposure is MSFT: Windows' behavior is reportedly treated as intentional, raising the probability that remediation requires an architectural change rather than a routine patch. That creates a two-stage risk over the next 1-3 months: enterprise security teams may impose compensating controls or accelerate endpoint-detection reviews, followed by a 6-18 month opportunity cost if regulated customers demand tighter OS-level isolation. The direct revenue impact is likely immaterial absent demonstrated large-scale exploitation, but a public dispute over responsibility can pressure MSFT's security-premium narrative and expand liability/reputational discount versus peers.

AAPL has lower near-term fundamental risk because its permission model appears to limit access to private directories, but its broader privacy valuation premium makes any evidence of practical user surveillance disproportionately important. The more investable second-order beneficiary is endpoint and identity security: CRWD, PANW, S and OKTA can sell detection, least-privilege, and device-control overlays where OS-native controls are viewed as incomplete. Android's unresolved exposure is a more material ecosystem risk for GOOG than for AAPL, particularly if consumer apps can demonstrate cross-app behavioral surveillance and regulators frame it as a platform-governance failure.

Consensus should resist treating this as a breach-equivalent event. Exploitation generally requires local code execution or an installed app, so there is no immediate evidence of mass compromise; remediation headlines could erase an initial MSFT discount quickly. The catalyst path is credible proof-of-concept adoption by malware, a government advisory, or enterprise procurement language referencing file-event leakage; absent those, this remains primarily a security-spending allocation signal rather than a directional mega-cap short.

Key Decisions for Investors

• Maintain a 1-3 month relative-value bias long CRWD or PANW versus MSFT; size modestly because the thesis is multiple support from endpoint-security demand, not a measurable Windows revenue loss. Exit if Microsoft ships a broad permission redesign or enterprise security guidance indicates no required compensating controls.
• Do not short AAPL on this development alone. Set an alert for reproducible macOS credential-theft or cross-user monitoring demonstrations; that would challenge the privacy-premium thesis and justify reassessing AAPL versus MSFT.
• Watch GOOG as the unpriced platform-risk read-through: evidence of a permissionless Android app exploiting private-app activity, or a Play Store/regulatory response, would support a 3-6 month long CRWD/short GOOG hedge rather than a standalone GOOG short.
• For MSFT, use any sharp event-driven weakness as a watch item rather than immediate downside positioning; require confirmation through exploited-in-the-wild reporting, a CISA-style advisory, or material enterprise customer restrictions before initiating a 1-3 month short.