CVE-2026-44964

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2

Description The OnCallNotificationActivity is declared as exported in the AndroidManifest.xml without a permission guard. This allows a co-installed malicious application to launch the activity using attacker-controlled Intent extras: on call page content, which is rendered as full-screen lock-screen text; page id, used to enqueue an on-call Acknowledge worker; and on call page intent, a Parcelable Intent. When a user taps the Acknowledge button, the application sends a forged Acknowledge request to the backend using the victim's authenticated session for the specified page id. Additionally, the attacker-controlled Intent is launched from the Datadog process via startActivity(), enabling access to non-exported components of the application through a confused-deputy pattern. The activity also enables lock-screen display and wakes the device, which can be used for social engineering. This issue requires a malicious application to be co-installed on the device and an active Datadog session.

Recommendations Update to version 545-5.9.2 or later.