On September 28, 2026, researchers at TU Graz described an Android side channel that lets an unprivileged app on the same device observe selected WhatsApp file events and names. The method does not reveal the contents of messages or media.
What a WhatsApp file event can reveal
The demonstrated app can receive notifications when media files arrive, are sent or are deleted. Filenames can suggest a file category, while folder locations can indicate whether media was sent or received. Together, those clues can outline some file activity—but they are metadata, not the messages or media themselves.
The notification marks a change in storage. It does not necessarily give the exact time a WhatsApp message arrived.
How FileObserver sees changes in a protected folder
Android’s FUSE layer provides apps with separate views of storage. In the demonstration, an ordinary file listing can hide WhatsApp’s media files from another app, yet Android’s FileObserver mechanism can still deliver notifications about file changes and reveal filenames. The watcher used in the demonstration does not need permissions to monitor the folder.
That gap between what an app can list and the events it can observe is the side channel: file activity becomes visible even though the app cannot read the files’ contents.
The local scope and the project’s Android fix listing
The observing app must be on the same device. The researchers’ project page lists “None” under Android fixes and says the team is unaware of exploitation beyond its tests.
