CVE-2026-44964

The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app.

Affected Versions

References

Credits