Exported Activity Vulnerability in Datadog Android Application

CVE-2026-44964

What is CVE-2026-44964?

The Datadog Android application contains a significant vulnerability due to the OnCallNotificationActivity being declared with 'android:exported="true"' in the AndroidManifest.xml without any permission restrictions. This flaw allows any other application co-installed on the same device to launch it, exploiting attacker-controlled Intent extras. When an attacker sends these Intents, they can trigger a forged Acknowledge request to the Datadog backend using the authenticated session of a victim user. Furthermore, this access to the activity allows the attacker to invoke functions that could dismiss the device's keyguard and turn on the screen, paving the way for social engineering attacks or basic annoyance tactics. The exploitation requires a malicious application on the same device as the victim and an active session within the Datadog app.

References