CVE-2026-44964
Received Received - Intake

Datadog Android App Activity Spoofing Vulnerability

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HackerOne

Description
The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-44964
EUVD
EUVD-2026-54570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datadog android_application *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Datadog Android app involves an exported activity (OnCallNotificationActivity) without permission restrictions. A malicious co-installed app can launch this activity with attacker-controlled inputs, triggering forged requests to Datadog's backend, launching unintended activities via the confused-deputy pattern, and waking the device screen for social engineering or annoyance attacks.

Detection Guidance

This vulnerability is specific to the Datadog Android application and requires detecting improperly configured exported activities. Check the AndroidManifest.xml for activities with android:exported="true" and no permission guards. Use the command: adb shell dumpsys package com.datadog.app | grep -A 10 "android:exported"

Impact Analysis

If exploited, this flaw could allow unauthorized acknowledgment of on-call pages using your authenticated session, potentially disrupting operations. It may also enable attackers to launch hidden activities within Datadog's app, bypassing security controls and using your device screen for phishing or harassment.

Mitigation Strategies

Update the Datadog Android application to the latest version where this issue is patched. If no patch is available, restrict installation of untrusted applications on the device. Disable the Datadog app's lock-screen permissions if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart