CVE-2026-47363

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 5.9.2

Description The launcher activity AppActivity is declared as exported with launchMode="singleTask" and lacks a permission guard. The application invokes Intent.getUserSession() during onCreate and onNewIntent, which deserializes a UserSession containing user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions from Bundle extras under the com.datadog.app.* namespace. A co-installed malicious application can invoke the launcher with arbitrary session extras, allowing the attacker to inject a session and perform an automatic login under an attacker-chosen identity. The session preparer returns a Ready state without contacting the backend if the injected access token is not flagged as expired, meaning no server-side token introspection occurs before auto-login. This results in an account-confusion issue where the victim's application is switched to a session controlled by the attacker.

Recommendations Update the Datadog Android application to version 5.9.2 or later.