CVE-2026-47364

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2

Description The application associates the user's Datadog UUID—a stable per-user identifier—with the device's Firebase installation ID on Google's backend by calling FirebaseCrashlytics.setUserId upon successful login. Uncaught exceptions are then forwarded to Firebase Crashlytics via the recordException() function, attaching stack traces and breadcrumbs to that same UUID. This process occurs without a visible consent gate or user-facing opt-out mechanism, making the UUID and crash data visible within Firebase Crashlytics.

Recommendations Update the Datadog Android application to version 545-5.9.2 or later.