CVE-2026-47363: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

PT-2026-69090

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 554-5.9.4 Description Two Room-backed SQLite databases store sensitive content in plaintext. The LocalNotificationDatabase contains notification titles, messages, recipients, services, tags, and...

CVE-2026-47364: Exposure of Sensitive Information to an Unauthorized Actor

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-47362: Insecure Storage of Sensitive Information

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47361: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-44965: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

PT-2026-69087

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2 Description The OnCallNotificationActivity is declared as exported in the AndroidManifest.xml without a permission guard. This allows a co-installed malicious application to launch the...

PT-2026-69088

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2 Description Six App Widget configuration activities—IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and...

PT-2026-69089

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 541-5.9.2 Description The BubbleChatActivity is exported without a permission guard and accepts a SEND intent with a mimeType of text/plain. The activity reads a conversation id from Intent extras...