CVE-2026-44964

Executive Summary

CVE-2026-44964 is a high-severity confused-deputy vulnerability in the Datadog Android application (com.datadog.app) caused by an improperly exported OnCallNotificationActivity component. Any malicious application co-installed on the same Android device can launch this activity without permissions, enabling an attacker to forge on-call acknowledgment requests using the victim’s authenticated Datadog session, launch arbitrary Intents from within the Datadog process (reaching non-exported components), and dismiss the device keyguard as part of a social engineering chain. The vulnerability requires local co-installation and an active Datadog session, but the impact spans data integrity (forged acks), privilege escalation (confused-deputy access to internal components), and physical-device disruption. No patch is currently available from any tracked source.

Technical Analysis

Vulnerability Mechanism

The flaw originates in the AndroidManifest.xml declaration of OnCallNotificationActivity within the Datadog Android application:

<activity
    android:name=".OnCallNotificationActivity"
    android:exported="true">

The android:exported="true" attribute permits any application on the device — regardless of its permission set — to resolve and launch this activity. Critically, there is no android:permission attribute and no runtime permission check inside the activity’s onCreate() to validate the calling package.

Attack Surface — Attacker-Controlled Intent Extras

When launched via an explicit Intent, the activity accepts three attacker-controlled extras:

1. on_call_page_content — A string rendered as full-screen lock-screen text. This provides the attacker with arbitrary text display capability on the victim’s locked device.

2. page_id — A string identifier used to construct and enqueue an "on-call Acknowledge" worker. This worker, upon execution, sends a POST request to the Datadog backend API (api.datadoghq.com/api/v1/... endpoint) using the victim’s embedded authentication token/session, acknowledging the attacker-selected on-call page.

3. on_call_page_intent — A Parcelable (specifically an Intent object). This is stored in the activity’s state and subsequently passed to startActivity() after the user taps the Acknowledge button.

Critical Execution Path

The exploitation chain within the activity:

1. Launch — The activity calls setShowWhenLocked(true) and setTurnScreenOn(true), waking the device and enabling display above the lock screen.

2. User interaction required — The malicious activity presents a UI (rendered from on_call_page_content) with an "Acknowledge" button. The victim must tap it once.

3. Post-tap actions:

   • A forged acknowledgment request fires to the Datadog backend for the attacker-specified page_id, authenticated as the victim.
   • The stored on_call_page_intent is passed to startActivity() from within the Datadog process (com.datadog.app). Because the call originates from the Datadog application’s process context, it carries Datadog’s UID and permission set. This is the core confused-deputy pattern (CWE-441): the attacker (a low-privileged app) abuses a privileged app’s capabilities.
   • The keyguard is dismissed and the screen remains on — a device disruption/social-engineering vector.

Why This Matters

• Component exposure: android:exported="true" without a permission guard is an Android security anti-pattern. The Android framework provides AndroidManifest.xml permission attributes and the checkCallingPermission() API for defense; neither is used here.
• Authentication bypass: The Datadog session token is private to the victim’s app. The attacker never reads it — instead, they trigger an API call from within the Datadog process using the app’s embedded session.
• Lateral reach: The on_call_page_intent enables an attacker to launch any component within com.datadog.app that is non-exported (e.g., internal WebViews, file pickers, or other handlers), potentially chaining into further vulnerabilities.

Exploitation Scenarios

Attack Chain — Forged On-Call Acknowledgment + Internal Component Access

Preconditions:

• A malicious application installed on the same Android device as Datadog.
• The victim has an active, authenticated Datadog session (logged-in state).
• The Datadog app is installed but may be in the background or foregrounded.

Step 1 — Reconnaissance & Target Identification The attacker crafts a malicious Android app (e.g., disguised as a utility or game) that, upon installation, performs reconnaissance:

• Enumerates installed packages to confirm com.datadog.app exists:

  PackageManager pm = getPackageManager();
  try {
      pm.getPackageInfo("com.datadog.app", 0);
      // Datadog present — proceed
  } catch (PackageManager.NameNotFoundException e) {
      // Datadog not installed — abort silently
  }
  

• Checks whether the Datadog app has a running service or recent usage (via UsageStatsManager if granted) to infer an active session.

Step 2 — Trigger / Weaponization The attacker’s app constructs the malicious Intent:

Intent intent = new Intent();
intent.setClassName("com.datadog.app", "com.datadog.app.OnCallNotificationActivity");
intent.putExtra("on_call_page_content",
    "CRITICAL ALERT: Production Database DOWN — Acknowledge to begin rollback.");
intent.putExtra("page_id", "5f3c9a2e-7d1b-4e58-9c04-3a6f2b8d1e7a"); // attacker-chosen page

// Deep-link into an internal Datadog component (e.g., debug file viewer)
Intent innerIntent = new Intent();
innerIntent.setClassName("com.datadog.app", "com.datadog.app.internal.DebugSettingsActivity");
innerIntent.putExtra("read_file", "/data/data/com.datadog.app/shared_prefs/datadog_preferences.xml");

intent.putExtra("on_call_page_intent", innerIntent);
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
startActivity(intent);

The attacker app triggers this via a scheduled AlarmManager broadcast at a time when the victim is likely to interact (e.g., during work hours) or via a social-engineering prompt inside the malicious app ("Tap to check for updates").

Step 3 — Payload / Execution

• The device screen wakes, revealing the forged alert text on the lock screen (on_call_page_content).
• The victim, seeing a legitimate-looking Datadog alert, taps Acknowledge.
• Immediately: a. The Datadog process sends an authenticated API call to https://api.datadoghq.com/api/v1/... acknowledging the attacker’s page_id. This creates a false record in the victim’s on-call history and falsely marks a page as handled — potentially suppressing real escalation for an actual incident. b. The attacker’s innerIntent fires startActivity() inside the Datadog process, launching DebugSettingsActivity (non-exported). The attacker’s app gains read access to Datadog’s private SharedPreferences (which may contain API keys, session tokens, or user preferences) via the path traversal in the debug view.

Step 4 — Post-Exploitation Impact

• Data exfiltration: The debug view’s content may be screenshot by the attacker app via MediaProjection (if the victim grants a permission prompt) or rendered and captured.
• Session hijacking: If the attacker extracts a session token or API key, they can replay it from their own infrastructure to access the victim’s Datadog account remotely.
• Denial of service: Repeated launches of the activity cause continuous screen wake-ups and keyguard dismissals, draining battery and disrupting device usage.

Alternative Scenario — Keyguard Dismissal as Social Engineering

The attacker sets on_call_page_content to a message that mimics a system dialog ("Your device has been compromised. Tap here to scan."). The keyguard dismissal and screen-on behavior lend authenticity. A malicious overlay (using SYSTEM_ALERT_WINDOW if granted) can then capture subsequent user input, leading to credentials theft.

Impact Assessment

Business Impact

• On-call integrity compromise: The forged acknowledgment corrupts the on-call paging system’s audit trail. A false acknowledgment may cause a real incident to go unnoticed, leading to prolonged service disruption and financial loss.
• Data confidentiality: The confused-deputy pattern enables access to Datadog’s internal components, potentially exposing session tokens, API keys, and user settings stored in the app sandbox.
• Reputational damage: Users may attribute the malicious activity to Datadog’s app, eroding trust in the mobile on-call solution.

Affected Systems

• Platform: Android — all versions supported by the Datadog app (targeting API 21+; the vulnerable code path is OS-agnostic).
• Datadog mobile app versions: All versions containing the OnCallNotificationActivity with android:exported="true" and no permission guard. The NVD description does not specify a fixed version, and the patch confidence is 0/4, indicating no patched version is known.

Blast Radius

• Local-only: Requires co-installed malicious app — limits remote exploitation but relevant for malware distributed via sideloading or malicious SDKs.
• User interaction: One tap on the Acknowledge button is required; this is not zero-click.
• CVSS scoring: Not provided (N/A). Given the local attack vector, low attack complexity, and confidentiality/integrity/availability impacts, a realistic score would be in the High range (7.0–8.9) on the CVSS v3.1 scale, though official scoring is pending.

Detection Guidance

Sigma Rule

title: Datadog Android OnCallNotificationActivity Abused via Exported Activity
id: 3f7a2b8c-4e5d-4f6a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects Android log entries indicating launch of Datadog's OnCallNotificationActivity by a non-Datadog package, signaling potential confused-deputy abuse (CVE-2026-44964).
tags:
    - attack.t1204
    - attack.execution
    - attack.t1557
    - cve.2026-44964
logsource:
    product: android
    category: activity_manager
detection:
    selection:
        EventName|startswith: 'am_proc_start'
        TargetComponent|contains: 'OnCallNotificationActivity'
        CallingPackage|contains: 'com.datadog.app.'
    filter:
        TargetPackage: 'com.datadog.app'
        CallingPackage: 'com.datadog.app'
    condition: selection and not filter
falsepositives:
    - Datadog app launching its own notification activity (covered by filter)
level: high

YARA Rule

rule Android_Datadog_OnCallNotificationActivity_Export {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects AndroidManifest.xml with exported OnCallNotificationActivity in Datadog app without permission guard"
        cve = "CVE-2026-44964"
        date = "2026-02-15"
        severity = "high"
    strings:
        $s1 = "OnCallNotificationActivity" ascii
        $s2 = "android:exported=\"true\"" ascii
        $s3 = "com.datadog.app" ascii
        $s4 = "android.permission." ascii
    condition:
        all of ($s1, $s2, $s3) and not $s4
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-44964 Datadog Android OnCall Acknowledgment API Abuse"; flow:to_server,established; http.uri; content:"/api/v1/"; http.uri; content:"acknowledge"; http.uri; content:"page_id"; http.header; content:"Authorization"; http.header; content:"Bearer"; http.hostname; content:"api.datadoghq.com"; classtype:attempted-user; reference:cve,2026-44964; sid:202644964; rev:1;)

Elastic EQL

any where
  event.category == "process" and
  process.name == "datadog" and
  process.args : "*OnCallNotificationActivity*" and
  process.args : "*startActivity*" and
  network.protocol == "http" and
  url.domain == "api.datadoghq.com"

Splunk SPL Query

index=android sourcetype="android:logcat"
| spath input=message
| search message="*OnCallNotificationActivity*" OR message="*startActivity*"
| rex field=_raw "Calling package: (?<calling_pkg>[^\s]+)"
| rex field=_raw "Target package: (?<target_pkg>[^\s]+)"
| where target_pkg=="com.datadog.app" AND calling_pkg!="com.datadog.app"
| stats count by calling_pkg, target_pkg, _time, source
| sort - _time

Wazuh OSSEC Rule

<rule id="100264" level="12">
    <if_sid>100263</if_sid>
    <field name="message">OnCallNotificationActivity</field>
    <description>CVE-2026-44964: Datadog Android OnCallNotificationActivity launched from external app — potential confused-deputy abuse.</description>
    <group>datadog,cve,android,</group>
    <mitre>
        <id>T1204</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from NVD, vendor advisories, or OSV package sources. The vendor has not released a fixed version ([ ] affected versions list, no vendor fix reference).

1) Immediate Mitigations (No Patch Available)

• Restrict installation sources: Enforce adb install policies that block sideloaded apps in enterprise-managed devices (via MDM such as Intune or Workspace ONE).
• App isolation: Use Android Enterprise work profiles or a dedicated device container that restricts communication between the Datadog app and third-party apps.
• User awareness: Instruct on-call personnel to be suspicious of any Datadog alert that appears on the lock screen without a corresponding notification from the Datadog app’s normal channel.
• Disable lock-screen display: In Android 12+ (targeted for the app), revoke the MediaProjection and overlay permissions from Datadog if available, though this may break legitimate notification features.

2) Patch / Upgrade Steps

• Monitor vendor channels: Subscribe to Datadog’s Android SDK release notes (https://github.com/DataDog/dd-sdk-android/releases) and security advisories (https://www.datadoghq.com/security/).
• Immediately apply when available: When a fix ships, update the Datadog app via the Play Store or an internal patch-management system. Validate the manifest now shows android:exported="false" or has an explicit android:permission guard.
• Temporary app freeze: If operating in a managed environment, pin the Datadog app version and block automatic updates to prevent introduction of other regressions, but ensure a rapid rollout on patch release.

3) Long-Term Hardening

• Code review for exported components: For any Android app in the organization, conduct a static analysis pass using tools like MobSF or Qark to detect android:exported="true" without permission guards.
• Adopt Android’s PermissionController: Ensure the platform’s runtime permission model (API 23+) is enforced; request explicit permissions for inter-app communication.
• Add a checkCallingUid() guard: The vendor should validate the calling package against getCallingPackage() inside onCreate() and reject non-Datadog callers.
• Replace startActivity with bounded intents: If the on_call_page_intent is genuinely required, restrict it to known-safe components via PackageManager.resolveActivity() with MATCH_DIRECT_BOOT_AWARE and explicit component filtering.
• Deploy RASP: Consider runtime application self-protection (e.g., Guardsquare DexGuard) to detect and block intent-based abuse at runtime.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-44964
2. MITRE ATT&CK — https://attack.mitre.org/techniques/T1204/ (User Execution)
3. OWASP Mobile Top 10 — https://owasp.org/www-project-mobile-top-10/ (M1: Improper Platform Usage)
4. Datadog Mobile SDK — https://github.com/DataDog/dd-sdk-android (monitor for future security fixes)
5. Android Developer Documentation — Exported Activities — https://developer.android.com/guide/components/activities/activity-lifecycle

Exploit-in-the-Wild Evidence: CISA KEV status is NO. No public PoC or exploit code is confirmed. No threat-actor campaigns are currently tracked for this CVE. Monitoring of underground forums is advised given the attack’s low complexity once prerequisite co-installation is achieved.