CVE-2026-44965

Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity. All six extend a shared base WidgetActivity that reads AppWidgetManager.EXTRA_APPWIDGET_ID from Intent extras and, when no resolved deep-link destination is supplied, uses that caller-controlled widget ID to look up the stored widget definition, fetch the associated user session, and perform an automatic login with source UserSessionSourceLogin.Automatic. Android App Widget IDs are small sequential integers assigned by AppWidgetManager. A zero-permission co-installed application can brute-force them by launching any of the six configuration activities with EXTRA_APPWIDGET_ID set to 1..N until one matches a configured widget on the victim device. When a match occurs, the activity foregrounds with the victim's session already loaded and renders the widget configuration UI, which is backed by live data pickers (SLOs, dashboards, incident severities and types, on-call pages and shifts) fetched through the victim's authenticated HTTP client. Exfiltration is screen-visible only — programmatic return of data to the caller is not possible from these activities. Disclosure is therefore a visual side-channel: accessibility services, screen recording, or screenshot capture. Preconditions: a malicious co-installed application, at least one of the six widgets configured on the victim's home screen, and an active Datadog session cached locally.

Affected Versions

References

Credits