CVE-2026-44964

CVE-2026-44964 in the Datadog Android app (versions prior to v545-5.9.2) has a CVSS 6.5 that badly understates the risk. The vulnerability centers on OnCallNotificationActivity—an exported activity that accepts Intent extras and executes them within Datadog's process context. That's the critical detail the scoring misses: Android's permission model operates at process boundaries, so code running inside Datadog's process inherits every permission Datadog holds. A co-installed app with only INTERNET permission can effectively buy a fully privileged code path by passing a malicious Intent as an extra. This isn't screen manipulation or forged UI in isolation—it's a universal privilege escalation bridge that reaches Datadog's non-exported components and, critically, the Datadog operational plane backend. The backend treats actions from inside this process as fully authenticated and authorized. The active session requirement does not meaningfully limit severity—it targets authenticated operators with legitimate Datadog access, not random users. Forged acknowledgement capability then becomes a mechanism for suppressing genuine incident alerts: an operator whose legitimate acknowledgment is suppressed misses a real incident. In healthcare, manufacturing, or critical infrastructure deployments, that is a direct safety risk, not merely operational annoyance. The fix is in v545-5.9.2. Beyond patching that specific version, audit other exported activities that handle Intent extras, particularly in notification handling and deep-linking code. This pattern—exported component plus Intent extra passthrough—is a known privilege escalation class with precedent in CVE-2013-2393 and CVE-2015-3887, and it recurs across mobile SDKs because it's the ergonomic default for notification and deep-link implementation. The presence of this pattern in Datadog likely indicates similar issues in other components.

Reviewed through automated stages and approved by a human before publication.