In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.
This requires:
A malicious application co-installed on the victim's device.
An active Datadog session in the Android app.
Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.
This requires:
A malicious application co-installed on the victim's device.
An active Datadog session in the Android app.
Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Datadog | Android App | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 08 Aug 2026 05:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Exported Activity Without Permission Guard Enables Forged On‑Call Acknowledgements in Datadog Android App |
Sat, 08 Aug 2026 03:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Datadog Android Exported Activity Enables Unauthorized Acknowledge Requests and Lock‑Screen Manipulation |
Sat, 08 Aug 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Sat, 08 Aug 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app. | In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process. This requires: A malicious application co-installed on the victim's device. An active Datadog session in the Android app. Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard. |
| References |
|
Fri, 07 Aug 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Datadog Android Exported Activity Enables Unauthorized Acknowledge Requests and Lock‑Screen Manipulation |
Fri, 07 Aug 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app. | |
| Weaknesses | CWE-441 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-08-08T01:05:53.334Z
Reserved: 2026-05-08T15:00:02.447Z
Link: CVE-2026-44964
Vulnrichment
Updated: 2026-08-07T18:36:56.762Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-08T05:00:09Z
Weaknesses