CVE-2026-47364
Received Received - Intake

Datadog Android App Crashlytics User UUID Exposure

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HackerOne

Description
On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID. No visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-47364
EUVD
EUVD-2026-54569

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
datadog android_application *
google firebase_crashlytics *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Datadog Android app sends a stable per-user Datadog UUID to Firebase Crashlytics on login, linking it to the device's Firebase installation ID. Uncaught exceptions are then reported to Crashlytics with stack traces that may include internal details like class names or breadcrumbs, all tied to the same UUID. No consent or opt-out mechanism for this tagging was found in the reviewed code paths.

Detection Guidance

This vulnerability involves potential exposure of Datadog UUIDs and crash data via Firebase Crashlytics. To detect it, inspect network traffic for outbound connections to Firebase Crashlytics endpoints (e.g., firebasecrashlytics.googleapis.com). Check app logs for Crashlytics-related entries or user UUID transmissions. Use tools like Wireshark or tcpdump to monitor traffic, and logcat for Android app logs.

Impact Analysis

This vulnerability could expose internal app details (e.g., crash stack traces, class names) to Crashlytics, potentially revealing sensitive operational data. While no direct personal data like email or name is sent, the UUID could still link crash reports to a specific user, raising privacy concerns.

Compliance Impact

The vulnerability may violate GDPR by processing user-identifiable crash data without explicit consent. For HIPAA, if the app handles health data, exposing internal crash details could risk unauthorized disclosure of protected information. Compliance hinges on whether the UUID and crash data qualify as personal or sensitive data under these regulations.

Mitigation Strategies

Disable Firebase Crashlytics reporting in the Datadog Android app if possible. Review app permissions to limit data collection. Update the app to a patched version if available. Consider using network monitoring to block unauthorized Crashlytics traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47364. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart