CVE-2026-47361

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 541-5.9.2

Description The BubbleChatActivity is exported without a permission guard and accepts a SEND intent with a mimeType of text/plain. The activity reads a conversation id from Intent extras and, upon the onDestroy() function call, triggers BubbleChatNotification.dismiss() if no active in-process session matches the provided conversation id. This process unconditionally cancels notification ID 9201, which corresponds to the hard-coded Bits AI chat notification, via NotificationManager.cancel without validating the caller's identity or ownership of the conversation id. Consequently, a co-installed application with zero permissions can launch BubbleChatActivity using a random conversation id to silently dismiss the Bits AI chat notification on the device. This issue does not result in data exposure as chat content is protected by server authentication.

Recommendations Update the Datadog Android application to version 541-5.9.2 or later.