Description

On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID. No visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T18:17:17.217Z",
  "pubdate": "2026-08-07T18:17:17.217Z",
  "executiveSummary": "The Datadog Android application contains a privacy and telemetry handling concern related to the unauthorized association of persistent user identifiers with third-party crash reporting infrastructure. Specifically, upon every successful login, the application invokes FirebaseCrashlytics.setUserId using the signed-in user's stable per-user Datadog UUID. This links the internal application user identifier with the device's Firebase installation ID on Google's remote backend without an explicit consent gate or user opt-out mechanism.\nThe impact of this behavior involves the telemetry-based linkage of crash telemetry, stack traces, internal class names, package names, in-flight frame data, and application breadcrumbs directly to a persistent, stable per-user identifier on a third-party analytics platform. The affected system is the Datadog Android application utilizing Firebase Crashlytics.\nThe risk implications center on unauthorized user profiling, telemetry correlation across third-party infrastructure, and potential privacy compliance violations due to the absence of explicit user consent or opt-out controls. Threat actors or entities with access to the Firebase Crashlytics project backend can harvest these correlated telemetry logs and stable identifiers. No specific authentication bypass or remote exploitation is required, as the telemetry linkage occurs automatically upon standard user authentication flows within the application codebase.",
  "technicalDetails": "The root cause of this vulnerability lies in the programmatic integration of FirebaseCrashlytics.setUserId within the authentication and session management lifecycle of the Datadog Android application. Upon a successful login event, the application retrieves the user's Datadog UUID—a stable, per-user identifier meaningful within the Datadog ecosystem—and passes it directly to the Crashlytics API.\nThe vulnerable components include the authentication event handlers and telemetry integration modules within the Datadog Android application. The affected function calls specifically involve FirebaseCrashlytics.setUserId and FirebaseCrashlytics.recordException. During standard runtime execution, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, automatically attaching detailed stack traces, internal package names, class names, application state breadcrumbs, and in-flight data referenced in crash frames to the previously established user UUID.\nThe step-by-step attack flow and payload behavior unfold as follows: First, a user authenticates successfully within the Datadog Android application. Second, the application executes the telemetry logic, invoking FirebaseCrashlytics.setUserId with the stable Datadog UUID, thereby establishing a permanent association between the user's identity and the device's Firebase installation ID on Google's servers. Third, when an application crash or unhandled exception occurs, the local runtime environment captures the execution state, including memory frames, internal class structures, and breadcrumbs. Fourth, the application invokes recordException to transmit this crash payload to the Firebase Crashlytics backend. Finally, because the session has been previously tagged via setUserId, the transmitted crash payload and associated internal application telemetry are systematically indexed against the user's stable Datadog UUID on the third-party platform.\nAuthentication and privilege requirements for this behavior are nominal; the mechanism triggers automatically during normal user interaction and standard authentication procedures without requiring elevated privileges or active interception. The network exposure involves outbound HTTPS telemetry transmission to Google's Firebase Crashlytics endpoints. Post-exploitation impact includes the persistent correlation of crash dumps, internal architectural metadata, and debug traces with identifiable user sessions on third-party infrastructure, bypassing user privacy expectations and regulatory consent requirements."
}