Description

The launcher activity AppActivity in the Datadog Android application is declared android:exported="true" with launchMode="singleTask" and no permission guard. On every onCreate and onNewIntent, it invokes Intent.getUserSession(), an extension that deserializes a full UserSession — user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions — from Bundle extras keyed under the com.datadog.app.* namespace. This extension lives in the main sourceset, not a test-only sourceset, despite a misleading comment referencing internal test fixtures. Any application installed on the device can invoke the launcher with arbitrary session extras. The startup pipeline accepts the injected session, persists it to user storage, optionally rotates persisted token storage when an OAUTH_OVERRIDE_TOKEN extra is set, and performs an automatic login under the attacker-chosen identity. The session preparer returns Ready without contacting the backend whenever the injected access token is not flagged as expired-or-expiring-soon, so no server-side token introspection takes place before auto-login. Preconditions: the Datadog application installed on the victim device, and a zero-permission co-installed malicious application. The attacker must possess any OAuth access token they are willing to have the victim use, including the attacker's own Datadog tokens.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-07T18:17:16.237Z",
  "pubdate": "2026-08-07T18:17:16.237Z",
  "executiveSummary": "The Datadog Android application suffers from an insecure component export and untrusted intent deserialization vulnerability residing in the launcher activity AppActivity. The vulnerability allows any co-installed, zero-permission malicious application on the device to interact directly with the exported component and inject arbitrary session data via Intent extras.\nThe impact of this vulnerability includes unauthorized account takeover and session spoofing. An attacker can force the victim application to perform an automatic login under an attacker-chosen identity by supplying a fully serialized UserSession object containing user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions.\nThe affected product is the Datadog Android application. The risk implications are severe, as the application accepts the injected session without backend token introspection when the access token is not flagged as expired, persisting the malicious session directly to user storage and optionally rotating token storage via the OAUTH_OVERRIDE_TOKEN extra.\nAttacker capabilities require the possession of any OAuth access token they wish the victim to use, such as their own Datadog tokens. Exploitation requirements include the target Datadog application installed on the victim device alongside a malicious zero-permission application capable of sending explicit or implicit intents to the vulnerable launcher activity.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper configuration of the launcher activity AppActivity within the Datadog Android application. AppActivity is explicitly declared with android:exported=\"true\" and launchMode=\"singleTask\" without any permission guard protecting its entry point. Consequently, any arbitrary local application on the Android device can invoke this launcher activity.\nThe vulnerable component utilizes an extension function, Intent.getUserSession(), located within the main sourceset rather than a test-only sourceset. Upon every invocation of onCreate and onNewIntent, the activity invokes this extension to deserialize a complete UserSession object from Bundle extras keyed under the com.datadog.app.* namespace.\nThe exploitation method follows a precise attack flow. First, a co-installed malicious application constructs an Intent targeting the AppActivity component of the Datadog application. The attacker populates the Intent with malicious Bundle extras under the com.datadog.app.* namespace, including a serialized UserSession containing arbitrary user identities, OAuth access and refresh tokens, organization data, and permissions. Optionally, the attacker can set the OAUTH_OVERRIDE_TOKEN extra to trigger rotation of persisted token storage.\nUpon receiving the malicious Intent, the application startup pipeline processes the injected session. The session preparer evaluates the injected access token and returns Ready without contacting the backend server for token introspection, provided the token is not flagged as expired-or-expiring-soon. The application then persists the fraudulent session to local user storage and executes an automatic login under the attacker-chosen identity.\nAuthentication and privilege requirements are minimal for exploitation; the attacking application requires zero permissions on the Android device. Network exposure is localized to the device IPC mechanism, but the post-exploitation impact allows an attacker to impersonate the victim, manipulate telemetry data within the context of the injected organization and datacenter, or force the user into an attacker-controlled monitoring session."
}