Description

Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity. All six extend a shared base WidgetActivity that reads AppWidgetManager.EXTRA_APPWIDGET_ID from Intent extras and, when no resolved deep-link destination is supplied, uses that caller-controlled widget ID to look up the stored widget definition, fetch the associated user session, and perform an automatic login with source UserSessionSourceLogin.Automatic. Android App Widget IDs are small sequential integers assigned by AppWidgetManager. A zero-permission co-installed application can brute-force them by launching any of the six configuration activities with EXTRA_APPWIDGET_ID set to 1..N until one matches a configured widget on the victim device. When a match occurs, the activity foregrounds with the victim's session already loaded and renders the widget configuration UI, which is backed by live data pickers (SLOs, dashboards, incident severities and types, on-call pages and shifts) fetched through the victim's authenticated HTTP client. Exfiltration is screen-visible only — programmatic return of data to the caller is not possible from these activities. Disclosure is therefore a visual side-channel: accessibility services, screen recording, or screenshot capture. Preconditions: a malicious co-installed application, at least one of the six widgets configured on the victim's home screen, and an active Datadog session cached locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-07T18:17:14.690Z",
  "pubdate": "2026-08-07T18:17:14.690Z",
  "executiveSummary": "An improper export vulnerability exists within the Datadog Android application affecting six App Widget configuration activities: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity.\nThese activities are explicitly declared with android:exported=true lacking permission guards and inherit from a shared base WidgetActivity.\nThe vulnerability allows an unprivileged co-installed malicious application to leverage the predictable, sequential nature of Android App Widget IDs to brute-force valid identifiers via Intent extras.\nUpon successful brute-forcing, the application initiates an automatic login using UserSessionSourceLogin.Automatic, exposing sensitive internal organization data including SLOs, dashboards, incident severities, and on-call schedules.\nThe exploitation vector results in a visual side-channel disclosure where data rendered in the foreground configuration UI can be exfiltrated via accessibility services, screen recording, or screenshot capture.\nSuccessful exploitation requires a malicious co-installed application, at least one configured widget on the victim device, and a locally cached active Datadog session.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper exposure of application components via the Android manifest. Specifically, IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity are declared with android:exported=true without enforcing any signature or custom permission barriers.\nAll six vulnerable components extend a shared base WidgetActivity which processes incoming Intent extras without validating the caller identity.\nThe shared base class extracts the AppWidgetManager.EXTRA_APPWIDGET_ID parameter provided by the calling intent. When a resolved deep-link destination is absent, the component uses this caller-controlled integer to query the stored widget definition.\nAndroid App Widget IDs are assigned as small sequential integers by the system AppWidgetManager. This predictable allocation scheme allows a zero-permission malicious co-installed application to systematically brute-force valid widget IDs by iterating through a range of integers (1..N) and launching any of the six configuration activities.\nWhen an injected EXTRA_APPWIDGET_ID matches an actively configured widget on the victim device, the application performs an automatic login leveraging the cached user session under the UserSessionSourceLogin.Automatic source.\nThe target activity then foregrounds and renders the widget configuration user interface, populating it with live data pickers retrieved via the victim's authenticated HTTP client. This data encompasses sensitive telemetry elements such as SLOs, dashboards, incident types, and on-call pages or shifts.\nBecause programmatic return of data directly to the calling application is restricted, exfiltration relies entirely on a visual side-channel. The attacking application utilizes device capabilities such as accessibility services, programmatic screenshot capture, or screen recording APIs to harvest the displayed information from the foregrounded UI.\nThe attack flow proceeds as follows: 1. The malicious co-installed application generates an explicit Intent targeting one of the exported widget configuration activities. 2. The attacker injects sequential integer values into the EXTRA_APPWIDGET_ID extra. 3. Upon striking a valid widget ID, the activity initializes the base WidgetActivity logic and retrieves the associated user session. 4. The application executes an automatic authentication routine, bypasses user interaction, and populates the UI with live operational data. 5. The malicious application captures the rendered screen contents via accessibility or visual recording mechanisms, completing the data exfiltration cycle."
}