In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.
This requires:
A malicious application co-installed on the victim's device.
An active Datadog session in the Android app.
Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Sat, 08 Aug 2026 05:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Exported Activity Without Permission Guard Enables Forged On‑Call Acknowledgements in Datadog Android App |
Sat, 08 Aug 2026 03:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Datadog Android Exported Activity Enables Unauthorized Acknowledge Requests and Lock‑Screen Manipulation |
Sat, 08 Aug 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Sat, 08 Aug 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app. | In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process. This requires: A malicious application co-installed on the victim's device. An active Datadog session in the Android app. Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard. |
| References |
|
Fri, 07 Aug 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Datadog Android Exported Activity Enables Unauthorized Acknowledge Requests and Lock‑Screen Manipulation |
Fri, 07 Aug 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app. | |
| Weaknesses | CWE-441 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-08-08T01:05:53.334Z
Reserved: 2026-05-08T15:00:02.447Z
Link: CVE-2026-44964
Vulnrichment
Updated: 2026-08-07T18:36:56.762Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-08T05:00:09Z