Vulnerability in Datadog Android Application Allows Session Hijacking via Widget Configuration Activities

CVE-2026-44965

What is CVE-2026-44965?

The Datadog Android application suffers from a security flaw where six widget configuration activities are improperly declared as exported without any permission restrictions. This deficiency allows a malicious co-installed app to exploit the system by bruteforcing the App Widget IDs. By leveraging the caller-controlled widget ID, an attacker can initiate an automatic login with a victim's session running in the background. Consequently, sensitive information from the active session can be visually exfiltrated via the widget configuration user interface, posing a significant risk to user privacy and security. The threat requires the presence of a malicious app and at least one configured widget on the target device.

References