Datadog up to 5.9.1 BubbleChatActivity BubbleChatNotification.dismiss conversation_id permission

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Datadog up to 5.9.1. This affects the function BubbleChatNotification.dismiss of the component BubbleChatActivity. The manipulation of the argument conversation_id leads to permission. This vulnerability is traded as CVE-2026-47361. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Datadog up to 5.9.1 and classified as problematic. This issue affects the function BubbleChatNotification.dismiss of the component BubbleChatActivity. The manipulation of the argument conversation_id with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is availability. The summary by CVE is:

BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss whenever no active in-process session matches the caller-supplied conversation_id. BubbleChatNotification.dismiss unconditionally cancels notification ID 9201 — the hard-coded Bits AI chat notification — using NotificationManager.cancel, with no validation of the caller's identity or ownership of the supplied conversation_id. A zero-permission co-installed application can therefore launch BubbleChatActivity with any random conversation_id; when the activity is finished, the Bits AI chat notification is cancelled on the victim device. No data exposure: chat content is server-authentication gated and is never returned to the caller. Shortcut removal is scoped to the attacker-supplied conversation ID, which is a random string and is not reachable without prior knowledge. Impact is confined to denial of the Bits AI chat notification (a nuisance and a potential aid to phishing of in-app workflows).

It is possible to read the advisory at trust.datadoghq.com. The identification of this vulnerability is CVE-2026-47361 since 05/19/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 5.9.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Network Management Software

Name

• Datadog

Version

• 5.9.0
• 5.9.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion