CVE-2026-47361: Medium severity Datadog Datadog Android application vulnerability
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation. This requires a malicious application co-installed on the victim's device. Impact: A co-installed application can silently dismiss the victim's Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Datadog Android applicationto a version that resolves this vulnerability.Fixed in 541-5.9.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47361?
The severity of CVE-2026-47361 is rated at 16.
What is CVE-2026-47361 about?
CVE-2026-47361 involves the BubbleChatActivity in the Datadog Android application being declared with android:exported="true" without a permission guard.
How do I fix CVE-2026-47361?
To fix CVE-2026-47361, ensure that BubbleChatActivity is not exported or add proper permission checks to control access.
What risks are associated with CVE-2026-47361?
CVE-2026-47361 poses a risk of unauthorized access to sensitive chat data due to improper export settings.
Which software is affected by CVE-2026-47361?
CVE-2026-47361 affects the Datadog Android application.