CVE-2026-47361
Received Received - Intake

Bits AI Chat Notification Cancellation in Datadog Android App

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HackerOne

Description
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss whenever no active in-process session matches the caller-supplied conversation_id. BubbleChatNotification.dismiss unconditionally cancels notification ID 9201 — the hard-coded Bits AI chat notification — using NotificationManager.cancel, with no validation of the caller's identity or ownership of the supplied conversation_id. A zero-permission co-installed application can therefore launch BubbleChatActivity with any random conversation_id; when the activity is finished, the Bits AI chat notification is cancelled on the victim device. No data exposure: chat content is server-authentication gated and is never returned to the caller. Shortcut removal is scoped to the attacker-supplied conversation ID, which is a random string and is not reachable without prior knowledge. Impact is confined to denial of the Bits AI chat notification (a nuisance and a potential aid to phishing of in-app workflows).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-47361
EUVD
EUVD-2026-54567

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datadog android_application *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-926 The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Datadog Android app's BubbleChatActivity, which is set to accept external intents without proper permission checks. A malicious app can send a crafted intent to cancel the Bits AI chat notification by supplying a random conversation ID. The activity lacks validation, allowing any app to trigger notification dismissal.

Detection Guidance

This vulnerability is specific to the Datadog Android application and involves an exported activity that can be triggered by any co-installed app. Detection would require checking if the Datadog app is installed and inspecting its manifest for the vulnerable BubbleChatActivity with android:exported="true" and no permission guard.

Impact Analysis

The main impact is denial of the Bits AI chat notification, which could disrupt workflows and potentially aid phishing attempts. No data is exposed, and the attack requires a co-installed malicious app. The effect is limited to notification removal for a specific conversation ID.

Mitigation Strategies

Uninstall the Datadog Android application if you do not need it. If the app is required, check for updates from the vendor that may patch this issue. Avoid installing untrusted applications alongside trusted ones to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47361. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart