CVE-2026-44965

Received Received - Intake

Permissionless Widget Activity Session Hijack in Datadog Android App

Publication date: 2026-08-07

Last updated on: 2026-08-08

Assigner: HackerOne

Description

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) are exported with no permission guard. Each accepts a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID and, when no deep-link destination is resolved, uses it to load the matching widget's stored session and automatically log in as that user. Because Android widget IDs are small sequential integers, a co-installed application can brute-force this value to find one that matches a widget configured on the victim's device. This requires: A malicious application co-installed on the victim's device. At least one of the six widgets configured on the victim's home screen. An active Datadog session cached locally. Impact: The matching configuration activity opens in the foreground under the victim's session and renders live infrastructure data. Exposure is limited to a visual side channel (e.g., screen recording or accessibility services); the calling application cannot programmatically read the rendered data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-08

Generated

2026-08-28

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-44965

EUVD

EUVD-2026-54571

Affected Vendors & Products

Vendor	Product	Version / Range
datadog	datadog_android	to 4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-926	The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

Executive Summary

This vulnerability involves six Android App Widget configuration activities in the Datadog app that are improperly set to android:exported=true without permission guards. A malicious co-installed app can brute-force widget IDs to trigger these activities, loading the victim's authenticated session and exposing sensitive widget configuration data through visual side-channels like screen recording.

Detection Guidance

Check for co-installed apps with activities named IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, or DashboardWidgetActivity. Look for apps declaring android:exported=true without proper permissions. Use Android Studio's APK Analyzer or adb shell pm list packages -f to inspect manifest files for exported components.

Impact Analysis

If you have the Datadog app installed with configured widgets, a malicious app on your device could exploit this to access your session data. It allows attackers to view your widget configurations, such as dashboards, SLOs, or incident details, through screen visibility only. No direct data exfiltration occurs, but visual side-channels may capture sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing user session data through visual side-channels. Compliance may be impacted if sensitive information is disclosed without user consent.

Mitigation Strategies

Update the Datadog Android app to the latest version. Revoke Datadog sessions and clear app data. Disable widgets from the Datadog app if not needed. Monitor for suspicious screen recordings or accessibility service usage.

Hi! I’m here to help you understand CVE-2026-44965. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70