CVE-2026-47364: Infoleak
On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID. No visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47364?
The severity of CVE-2026-47364 is rated at 37.
How do I fix CVE-2026-47364?
To mitigate CVE-2026-47364, ensure to update the Datadog Android application to the latest version available.
What type of vulnerability is CVE-2026-47364?
CVE-2026-47364 is categorized as an information leak vulnerability.
What impact does CVE-2026-47364 have on user data?
CVE-2026-47364 may expose a user's Datadog UUID, linking it to the Firebase installation ID, potentially compromising user privacy.
When was CVE-2026-47364 published?
CVE-2026-47364 was published on August 7, 2026.