Datadog Android application
by Datadog
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-47364 | Med | 0.42 | 6.5 | — | Aug 7, 2026 | On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation… | ||
| CVE-2026-47361 | Med | 0.42 | 6.4 | — | Aug 7, 2026 | BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss… | ||
| CVE-2026-44964 | Med | 0.42 | 6.5 | — | Aug 7, 2026 | The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content… | ||
| CVE-2026-47363 | Med | 0.41 | 6.3 | — | Aug 7, 2026 | The launcher activity AppActivity in the Datadog Android application is declared android:exported="true" with launchMode="singleTask" and no permission guard. On every onCreate and onNewIntent, it invokes Intent.getUserSession(), an extension that deserializes a full UserSession… | ||
| CVE-2026-44965 | Med | 0.36 | 5.5 | — | Aug 7, 2026 | Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and… | ||
| CVE-2026-47362 | Med | 0.30 | 4.6 | — | Aug 7, 2026 | The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident… |
- risk 0.42cvss 6.5epss —
On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation…
- risk 0.42cvss 6.4epss —
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss…
- risk 0.42cvss 6.5epss —
The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content…
- risk 0.41cvss 6.3epss —
The launcher activity AppActivity in the Datadog Android application is declared android:exported="true" with launchMode="singleTask" and no permission guard. On every onCreate and onNewIntent, it invokes Intent.getUserSession(), an extension that deserializes a full UserSession…
- risk 0.36cvss 5.5epss —
Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and…
- risk 0.30cvss 4.6epss —
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident…