CVE-2026-47363 Overview
CVE-2026-47363 affects the Datadog Android application in versions prior to v541-5.9.2. The exported launcher activity AppActivity accepts attacker-supplied session data, including OAuth tokens, from Intent extras without a permission guard. The application signs into the supplied session without validating it against the Datadog backend. The flaw falls under CWE-926: Improper Export of Android Application Components. Exploitation requires a malicious application co-installed on the same device and an OAuth token the attacker is willing to load into the victim's app.
Critical Impact
A co-installed malicious application can switch the victim's Datadog app to an attacker-controlled session, producing an account-confusion condition that may redirect user actions and data entry into the attacker's account.
Affected Products
- Datadog Android application versions prior to v541-5.9.2
- Android devices with the vulnerable Datadog app installed alongside another application
- Deployments relying on the Datadog mobile client for observability workflows
Discovery Timeline
- 2026-08-07 - CVE-2026-47363 published to NVD
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-47363
Vulnerability Analysis
The Datadog Android application exports the AppActivity launcher activity without a permission guard. Any application on the device can construct an Intent targeting AppActivity and supply Intent extras containing session material, including OAuth tokens. The Datadog app reads the supplied session and signs the user into it without verifying token validity against the Datadog backend.
The resulting condition is account confusion. The victim's existing session is not directly exfiltrated, and existing data is not read by the attacker's process. Instead, the app is silently rebound to a session under the attacker's control. Subsequent user actions such as queries, dashboard interactions, and configuration changes execute inside the attacker's tenant. This creates opportunities for social engineering, credential capture through prompts inside the switched session, and observation of the victim's behavior in an attacker-monitored environment.
Root Cause
The root cause is improper export of an Android component combined with missing backend validation of session state. AppActivity is declared as exported at the manifest level and accepts session payloads through Intent extras. The activity trusts input from any calling package because no android:permission attribute and no runtime caller check restrict who can invoke it. The session-load path also lacks a server-side check that would reject tokens the user did not intentionally supply.
Attack Vector
Exploitation requires a co-installed application on the same device. The malicious app builds an explicit Intent targeting the Datadog package and AppActivity, attaches OAuth token material in the extras, and starts the activity. The Datadog app parses the extras and authenticates as the supplied identity. User interaction is required to continue the session, consistent with the CVSS user-interaction requirement. No network position or elevated Android privileges are required by the attacking app.
No public proof-of-concept is listed in the CVE record. See the Datadog Trust Center for vendor-issued technical details.
Detection Methods for CVE-2026-47363
Indicators of Compromise
- Unexpected sign-in events in Datadog audit logs originating from mobile clients tied to user accounts that do not belong to the device owner
- Session activity for a Datadog account from a device previously associated with a different account
- Intent launches targeting the Datadog package AppActivity from non-Datadog installer sources on managed Android devices
Detection Strategies
- Enroll corporate Android devices in a Mobile Device Management (MDM) platform and enumerate installed application inventories to identify unmanaged apps co-installed with Datadog
- Correlate Datadog authentication logs with the expected user-to-device mapping and alert on identity mismatches
- Monitor mobile client versions reported to the Datadog backend and flag devices running Datadog Android builds earlier than v541-5.9.2
Monitoring Recommendations
- Ingest Datadog audit and authentication events into a centralized SIEM for cross-account correlation
- Track OAuth token issuance and refresh anomalies for accounts that report mobile sessions from unfamiliar devices
- Alert on sudden account switches within short time windows on the same device fingerprint
How to Mitigate CVE-2026-47363
Immediate Actions Required
- Update the Datadog Android application to version v541-5.9.2 or later across all managed and BYOD devices
- Enforce mobile application version compliance through MDM policy and block outdated builds from accessing Datadog
- Instruct users to install applications only from vetted sources and to review Datadog session identity before entering sensitive queries
Patch Information
Datadog fixed the issue in Android application version v541-5.9.2. The patched build removes the ability for external callers to inject session material into AppActivity and adds backend validation of session state. Refer to the Datadog Trust Center for the vendor advisory and release notes.
Workarounds
- Uninstall the Datadog Android application on devices that cannot be updated until the patched build is deployed
- Restrict Datadog mobile access to devices under MDM control with an approved application allowlist
- Sign out of the Datadog Android app when not in active use to reduce the window during which an attacker can trigger a session switch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
