CVE-2026-44965 in Datadog
Summary
by MITRE • 08/07/2026
Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity. All six extend a shared base WidgetActivity that reads AppWidgetManager.EXTRA_APPWIDGET_ID from Intent extras and, when no resolved deep-link destination is supplied, uses that caller-controlled widget ID to look up the stored widget definition, fetch the associated user session, and perform an automatic login with source UserSessionSourceLogin.Automatic. Android App Widget IDs are small sequential integers assigned by AppWidgetManager. A zero-permission co-installed application can brute-force them by launching any of the six configuration activities with EXTRA_APPWIDGET_ID set to 1..N until one matches a configured widget on the victim device. When a match occurs, the activity foregrounds with the victim's session already loaded and renders the widget configuration UI, which is backed by live data pickers (SLOs, dashboards, incident severities and types, on-call pages and shifts) fetched through the victim's authenticated HTTP client. Exfiltration is screen-visible only — programmatic return of data to the caller is not possible from these activities. Disclosure is therefore a visual side-channel: accessibility services, screen recording, or screenshot capture. Preconditions: a malicious co-installed application, at least one of the six widgets configured on the victim's home screen, and an active Datadog session cached locally.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical privilege escalation flaw in the Datadog Android application where six widget configuration activities are improperly exposed without access controls. The vulnerability stems from the declaration android:exported="true" combined with the absence of any permission requirements for these activities, creating an attack surface that allows malicious applications to gain unauthorized access to sensitive user data. According to CWE-284, this constitutes an improper access control vulnerability where the application fails to properly restrict access to its components, while the ATT&CK framework categorizes this as privilege escalation through application component exposure.
The technical mechanism involves a brute force attack vector where a malicious co-installed application can iterate through sequential widget IDs from 1 to N until it finds a match with an existing widget on the victim's device. The shared base WidgetActivity class processes the AppWidgetManager.EXTRA_APPWIDGET_ID parameter from Intent extras, which serves as the attack surface for this vulnerability. When a matching widget ID is discovered, the activity automatically performs authentication using UserSessionSourceLogin.Automatic, effectively logging in with the victim's credentials without any user interaction or explicit authorization. This automatic login process occurs through the AppWidgetManager's widget management system where the widget ID serves as an identifier that can be used to retrieve stored widget definitions and associated user sessions.
The operational impact of this vulnerability is significant as it enables unauthorized access to live data pickers that are populated with sensitive information from the victim's Datadog account. These pickers include SLOs, dashboards, incident severities and types, on-call pages and shifts, all of which are rendered within the widget configuration UI. The vulnerability creates a visual side-channel exposure where sensitive data becomes visible to unauthorized applications through accessibility services, screen recording capabilities, or screenshot capture mechanisms. Even though the activities cannot programmatically return data to the malicious application, the screen-visible disclosure provides sufficient information to compromise user privacy and potentially enable further attacks against the victim's Datadog account.
The vulnerability requires three specific preconditions to be exploited successfully: a malicious co-installed application must be present on the device, at least one of the six vulnerable widgets must be configured on the victim's home screen, and an active Datadog session must be cached locally on the device. This dependency structure limits the attack scope but does not eliminate the severity of the exposure. The sequential nature of widget ID assignment makes brute-forcing relatively efficient, potentially requiring only a few hundred attempts to find a valid widget ID in typical usage scenarios. According to security best practices and mobile application security standards, this represents a serious configuration error where exported components should always be protected by appropriate permission checks or other access controls to prevent unauthorized component invocation. The vulnerability demonstrates the importance of proper Android manifest configuration and highlights the risks associated with default-exported activities that can be invoked by any application on the device without proper authentication or authorization mechanisms in place.