CVE-2026-47361 in Datadog
Summary
by MITRE • 08/07/2026
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss whenever no active in-process session matches the caller-supplied conversation_id. BubbleChatNotification.dismiss unconditionally cancels notification ID 9201 — the hard-coded Bits AI chat notification — using NotificationManager.cancel, with no validation of the caller's identity or ownership of the supplied conversation_id. A zero-permission co-installed application can therefore launch BubbleChatActivity with any random conversation_id; when the activity is finished, the Bits AI chat notification is cancelled on the victim device. No data exposure: chat content is server-authentication gated and is never returned to the caller. Shortcut removal is scoped to the attacker-supplied conversation ID, which is a random string and is not reachable without prior knowledge. Impact is confined to denial of the Bits AI chat notification (a nuisance and a potential aid to phishing of in-app workflows).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described represents a privilege escalation issue within the Datadog Android application where the BubbleChatActivity component is improperly configured with android:exported="true" and lacks proper permission controls. This activity accepts SEND intents with text/plain mime type and processes conversation_id values from intent extras, creating an attack surface that allows unauthorized applications to manipulate notification behavior. The flaw stems from the activity's design pattern where it reads a conversation_id parameter and subsequently calls BubbleChatNotification.dismiss during onDestroy, a method that unconditionally cancels notification ID 9201 without validating caller identity or conversation ownership.
This security weakness directly maps to CWE-284 Access Control Bypass, as the application fails to implement proper access controls for critical notification management functions. The vulnerability exploits the Android intent system's lack of permission enforcement, allowing any co-installed application with zero permissions to trigger the activity and potentially manipulate notifications. The absence of caller authentication mechanisms means that an attacker can supply arbitrary conversation_id values, which the system processes without verification of legitimacy or ownership, creating a path for unauthorized notification manipulation.
The operational impact of this vulnerability manifests as a denial-of-service condition affecting the Bits AI chat notification functionality. Attackers can cancel legitimate chat notifications simply by launching the BubbleChatActivity with random conversation identifiers, effectively removing important in-app communication elements that users might rely upon for workflow completion. This particular attack vector is particularly concerning because it could be used to aid phishing operations by removing notification indicators that users depend on to identify genuine application interactions. The notification cancellation affects only the Bits AI chat notification (ID 9201) and does not expose any sensitive data since chat content remains server-authentication gated, but the disruption to user experience and potential workflow interference creates significant operational risks.
The security implications extend beyond simple notification manipulation as they represent a broader pattern of insufficient input validation and lack of proper access control enforcement. The vulnerability demonstrates how Android application developers must carefully evaluate exported components and implement appropriate permission checks before allowing external applications to interact with sensitive system functions. Mitigation strategies should include implementing proper permission requirements for the BubbleChatActivity, validating caller identity through signature verification or other authentication mechanisms, and ensuring that notification management operations require explicit authorization tokens or session validation rather than accepting arbitrary identifiers from untrusted sources. Additionally, the hardcoded notification ID 9201 should be replaced with a more dynamic approach that validates notification ownership before cancellation to prevent unauthorized manipulation of user notifications.
The attack surface for this vulnerability aligns with ATT&CK technique T1546.008 Abuse Elevation of Privilege through Android Components, where attackers leverage exported components and permission gaps to escalate their privileges within the application context. This particular vector is particularly dangerous because it requires no special permissions from the attacker, making it accessible to any co-installed application that can launch intents. The vulnerability also relates to T1566.002 Phishing via Social Media where notification removal could be used as a supporting technique to make phishing attacks more effective by eliminating visual indicators that users rely upon for identifying legitimate application interactions.
Security hardening should implement permission-based access control for the BubbleChatActivity component, requiring either signature verification or explicit user consent before allowing notification manipulation operations. The conversation_id validation process must include cryptographic proof of ownership or authentication tokens that verify the caller's legitimate access to the specified conversation. Additionally, the hardcoded notification ID approach should be replaced with a dynamic lookup mechanism that validates notification ownership through session management or authentication state verification to prevent unauthorized cancellation of user notifications. These improvements would align with Android security best practices and mitigate the risk of similar privilege escalation vectors in future application development cycles.
The vulnerability demonstrates how seemingly minor configuration issues can create significant security implications in mobile applications, particularly when exported components lack proper access controls and input validation mechanisms. The absence of proper authentication checks for notification management functions creates a persistent attack vector that can be exploited by any co-installed application without requiring elevated privileges or special user interaction. This particular flaw underscores the importance of implementing defense-in-depth strategies where multiple layers of security controls work together to prevent unauthorized access to sensitive system functions, even when individual components might appear harmless in isolation. The remediation approach must include comprehensive review of all exported Android components to ensure that proper permission requirements and authentication mechanisms are implemented before allowing external applications to interact with potentially sensitive system resources.