Description

The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T18:17:14.570Z",
  "pubdate": "2026-08-07T18:17:14.570Z",
  "executiveSummary": "An improper authorization and confused deputy vulnerability exists within the Datadog Android application due to an unprotected exported activity, OnCallNotificationActivity, declared in AndroidManifest.xml.\nThis flaw allows any co-installed malicious application on the local device to launch the activity using attacker-controlled Intent extras, resulting in unauthorized actions performed under the victim's authenticated session.\nThe impact includes forced acknowledgment of arbitrary on-call pages via the Datadog backend, the launching of arbitrary intents into non-exported components of com.datadog.app via a confused-deputy pattern, and the forced wake-up and unlocking of the victim's device screen displaying custom lock-screen text.\nThe risk implication is significant as it compromises the integrity of incident response workflows and leverages the application's privileged context for unauthorized internal component access.\nAttacker capabilities require a co-installed malicious application on the target device alongside an active authenticated Datadog session.\nNo specific version numbers were provided in the input, but the affected product is explicitly the Datadog Android application.",
  "technicalDetails": "The vulnerability resides in the OnCallNotificationActivity component of the Datadog Android application, which is explicitly declared with android:exported=\"true\" in AndroidManifest.xml without any permission guard protecting its access.\nBecause the component is exported and unprotected, any co-installed application on the same Android device can construct and send an explicit or implicit Intent to launch OnCallNotificationActivity with arbitrary, attacker-controlled Intent extras.\nUpon launch, the activity utilizes API flags such as setShowWhenLocked and setTurnScreenOn to automatically wake the device and render attacker-controlled text on the full-screen lock-screen using the on_call_page_content extra.\nThe core exploitation vector relies on a multi-step user interaction combined with a confused-deputy pattern. The attacker supplies a target page_id via Intent extras, which the application uses to enqueue an on-call Acknowledge worker.\nWhen the victim taps the Acknowledge button, three distinct malicious effects are triggered: first, a forged Acknowledge request is transmitted to the Datadog backend for the attacker-specified page_id, leveraging the victim's valid and authenticated session; second, a Parcelable Intent supplied via the on_call_page_intent extra is executed via startActivity from within the trusted context of the Datadog process, granting the attacker reach into non-exported components of com.datadog.app; third, the device keyguard is dismissed.\nPrerequisites for this attack include the presence of a malicious co-installed application on the victim's device and an active, authenticated user session within the Datadog Android app.\nThe attack flow proceeds as follows: (1) The malicious application broadcasts or starts OnCallNotificationActivity with crafted extras including on_call_page_content, page_id, and on_call_page_intent; (2) The Datadog application handles the Intent, wakes the screen, and displays the attacker's text; (3) The victim interacts with the UI by tapping the Acknowledge button; (4) The application executes the backend API call with the forged page_id and invokes startActivity on the attacker-controlled Parcelable Intent from its own privileged process."
}