CVE-2026-44965

Executive Summary

CVE-2026-44965 is a local privilege escalation vulnerability in the Datadog Android application caused by six App Widget configuration activities being declared android:exported="true" without any permission guard. A zero-permission co-installed application can brute-force App Widget IDs to trigger an automatic login using the victim's stored session, then render widget configuration UI backed by the victim's authenticated HTTP client. The impact is visual disclosure of sensitive SLO, dashboard, incident, and on-call data via screenshot, screen recording, or accessibility services. The vulnerability is currently unpatched with no vendor fix available.

Technical Analysis

The vulnerability exists in six Activity classes in the Datadog Android application: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity. All six extend a shared base class WidgetActivity and are declared with android:exported="true" in the application manifest, with no permission enforcement.

Vulnerability Mechanism

The exported activities read AppWidgetManager.EXTRA_APPWIDGET_ID from the incoming Intent's extras. When no resolved deep-link destination is supplied, the activity uses the caller-controlled widget ID to:

1. Look up the stored widget definition associated with that ID
2. Fetch the associated user session from persistent storage
3. Perform an automatic login using UserSessionSourceLogin.Automatic

This flow bypasses the normal authentication gate because the widget configuration flow is designed to rehydrate an existing session rather than prompt for credentials. The attacker-controlled widget ID is used as a lookup key with no validation that the caller owns the corresponding widget instance.

Attack Surface

Android App Widget IDs are small sequential integers assigned by the AppWidgetManager. This makes them trivially brute-forceable. A malicious zero-permission application can:

• Launch any of the six exported activities with EXTRA_APPWIDGET_ID set to 1, 2, 3, ... N
• Detect which ID matches a configured widget on the victim device by observing activity launch success/failure behavior
• When a match occurs, the activity foregrounds with the victim's session already authenticated

Authentication Bypass

The automatic login performed via UserSessionSourceLogin.Automatic means the attacker does not need to steal tokens, intercept credentials, or exploit the Android Keystore. The session cookie or OAuth token is fetched internally by the legitimate application, then used to populate the widget configuration UI with live data.

Exfiltration Constraints

Exfiltration is screen-visible only — programmatic return of data to the calling application is not possible from these activities. The disclosure vector is therefore a visual side-channel requiring either:

• An accessibility service (which the attacker app must already hold BIND_ACCESSIBILITY_SERVICE permission for)
• Screen recording (MediaProjection API — user-consented)
• Screenshot capture (requires a background access or a captured display)

This limits the attack to scenarios where the attacker can visually observe the screen or has pre-existing screen capture capabilities.

Exploitation Scenarios

Attack Chain Step 1 — Target Identification

The attacker identifies a victim device with the Datadog Android application installed and at least one App Widget configured on the home screen. The attacker's malicious APK is already installed (e.g., via social engineering, sideloading, or a malicious app store listing).

Attack Chain Step 2 — Widget ID Brute-Force

The attacker's application iterates through widget IDs:

for (int i = 1; i <= 1000; i++) {
    Intent intent = new Intent();
    intent.setClassName("com.datadog.app", "com.datadog.app.widget.IncidentWidgetActivity");
    intent.putExtra(AppWidgetManager.EXTRA_APPWIDGET_ID, i);
    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
    try {
        startActivity(intent);
    } catch (ActivityNotFoundException e) {
        // Activity not exported (unlikely here) — continue
    }
    // Detect if activity successfully foregrounded with a configured widget
}

Successful match detection is based on activity launch behavior — if the widget ID corresponds to a configured widget, the activity foregrounds normally with the session loaded. If no widget exists for that ID, the activity typically finishes immediately or displays an error state.

Attack Chain Step 3 — Session Rehydration and Data Exposure

Once a matching widget ID is found, the WidgetActivity base class:

1. Loads the widget configuration from internal storage
2. Fetches the user session (session token, cookies, or OAuth state)
3. Calls UserSessionSourceLogin.Automatic to establish an authenticated context
4. Renders the configuration UI with live data pickers

For SloWidgetActivity, this displays SLO (Service Level Objective) definitions. For DashboardWidgetActivity, it lists dashboards from the victim's Datadog organization. IncidentWidgetActivity shows incident severities and types. OnCallShiftsWidgetActivity and OnCallPagesWidgetActivity display on-call schedules and pages.

Attack Chain Step 4 — Data Exfiltration

With an accessibility service or screen capture capability, the attacker records:

• SLO names, targets, and current values
• Dashboard names and associated metrics
• Incident severity distribution
• On-call schedules (names, shifts, escalation policies)
• Service pages and contact routes

The attacker can also script the accessibility service to navigate through the rendered UI, expanding interaction with any displayed data.

Post-Exploitation Impact

While no direct data exfiltration to the attacker's server occurs via the activity itself, the attacker can configure the accessibility service to OCR the screen and send extracted text to a remote server. Alternatively, screen recording via MediaProjection (if user grants the consent prompt) captures the full session.

Impact Assessment

Business Impact

The vulnerability exposes sensitive operational data from the Datadog organization:

• Confidentiality Impact: High — SLOs, dashboards, on-call schedules, and incident configurations reveal internal business operations, availability targets, and personnel schedules
• Integrity Impact: None — The attacker cannot modify widget configuration or send requests through the victim's session in this attack path
• Availability Impact: None — No denial of service conditions are created

CVSS Context

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N — High severity (7.0–8.9 range)

• Attack Vector: Local (AV:L) — Requires co-installed malicious application on the same device
• Attack Complexity: Low (AC:L) — Widget ID brute-force is trivial with sequential integers
• Privileges Required: None (PR:N) — Zero-permission attacker app
• User Interaction: None (UI:N) — The victim does not need to interact with the malicious app
• Confidentiality Impact: High (C:H) — Sensitive Datadog organization data becomes visible

Affected Systems

• Android devices with Datadog mobile application installed, version unspecified
• All Android versions (the issue is in the app's manifest, not the OS)
• Datadog organizations with mobile widget usage

Blast Radius

The disclosed data includes operational metrics that could inform:

• Competitive intelligence — dashboard names reveal tooling and monitoring priorities
• Social engineering — on-call schedules reveal employee shifts and contact escalation paths
• Incident management insight — incident severity types and frequencies indicate organizational maturity

Detection Guidance

Sigma Rule

title: Datadog Android Widget Configuration Activity Abuse
id: 7f3c1b2a-9d4e-4f5a-8b3c-2a6d0e1f9c44
status: experimental
description: Detects repeated launch attempts of exported Datadog widget configuration activities with brute-forced widget IDs
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44965
tags:
    - attack.credential_access
    - attack.t1555
    - cve.2026.44965
logsource:
    category: process_creation
    product: android
detection:
    selection:
        Process.name: 'com.datadog.app'
        CommandLine|contains|all:
            - 'IncidentWidgetActivity'
            - 'MonitorSavedViewWidgetActivity'
            - 'OnCallShiftsWidgetActivity'
            - 'OnCallPagesWidgetActivity'
            - 'SloWidgetActivity'
            - 'DashboardWidgetActivity'
    condition: selection
    timeframe: 60s
level: medium

YARA Rule

rule CVE_2026_44965_Datadog_Widget_Exported_Activity {
    meta:
        author = "Valters IT Security Research"
        description = "Detects Datadog Android APK manifests with exported widget configuration activities"
        cve = "CVE-2026-44965"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "IncidentWidgetActivity" ascii fullword
        $s2 = "MonitorSavedViewWidgetActivity" ascii fullword
        $s3 = "OnCallShiftsWidgetActivity" ascii fullword
        $s4 = "OnCallPagesWidgetActivity" ascii fullword
        $s5 = "SloWidgetActivity" ascii fullword
        $s6 = "DashboardWidgetActivity" ascii fullword
        $s7 = "android:exported=\"true\"" ascii
        $s8 = "UserSessionSourceLogin.Automatic" ascii
    condition:
        (any of ($s1, $s2, $s3, $s4, $s5, $s6)) and
        $s7 and $s8
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-44965 - Datadog Android Widget Activity Exploitation"; flow:established,to_server; content:"com.datadog.app"; http.uri; pcre:"/(IncidentWidgetActivity|MonitorSavedViewWidgetActivity|OnCallShiftsWidgetActivity|OnCallPagesWidgetActivity|SloWidgetActivity|DashboardWidgetActivity)/Ui"; content:"EXTRA_APPWIDGET_ID"; http.uri; pcre:"/[0-9]+/Ui"; classtype:attempted-user; sid:2026044965; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_44965;)

Elastic Detection

sequence with maxspan=60s
  [ process where event.action == "start" and process.name : "com.datadog.app" and
    process.args : ("IncidentWidgetActivity", "MonitorSavedViewWidgetActivity", 
                   "OnCallShiftsWidgetActivity", "OnCallPagesWidgetActivity", 
                   "SloWidgetActivity", "DashboardWidgetActivity") ]
  [ process where event.action == "start" and process.name : "*" and
    process.parent.name : "com.datadog.app" and
    process.args : "*EXTRA_APPWIDGET_ID*" ]

Splunk SPL Query

index=android sourcetype=activity_log
| where process_name="com.datadog.app"
| regex activity="(IncidentWidgetActivity|MonitorSavedViewWidgetActivity|OnCallShiftsWidgetActivity|OnCallPagesWidgetActivity|SloWidgetActivity|DashboardWidgetActivity)"
| transaction src_ip maxspan=60s
| stats count by activity, src_ip, dwid
| where count > 3
| table _time, src_ip, activity, count

Wazuh OSSEC Rule

<group name="android_datadog,">
  <rule id="202604" level="10">
    <decoded_as>android_logcat</decoded_as>
    <match>com.datadog.app</match>
    <regex>(IncidentWidgetActivity|MonitorSavedViewWidgetActivity|OnCallShiftsWidgetActivity|OnCallPagesWidgetActivity|SloWidgetActivity|DashboardWidgetActivity)</regex>
    <regex>(EXTRA_APPWIDGET_ID|widget_id)</regex>
    <description>CVE-2026-44965: Datadog widget configuration activity invoked with caller-controlled widget ID</description>
    <group>android, datadog, cve_2026_44965,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor has not released a fixed version at the time of this report. The affected version range is unknown, and no vendor fix or workaround has been published.

Immediate Mitigations

1. Remove Datadog widgets from Android home screen — this reduces the success probability of widget ID brute-force
2. Disable the Datadog mobile app's widget capability if an in-app toggle exists
3. Audit installed applications for accessibility service usage — revoke BIND_ACCESSIBILITY_SERVICE from any non-trusted application
4. Restrict side-loading — enforce "Unknown sources" disabled on corporate-managed devices
5. Deploy Mobile Device Management (MDM) policy to block installation of unapproved applications

Patch/Upgrade Steps

1. Monitor vendor advisories: https://security.datadoghq.com and the Datadog mobile application release notes
2. When a patched version is released, prioritize deployment to all Android endpoints within 72 hours
3. Verify the patch removes android:exported="true" from the six widget configuration activities or adds a permission guard

Long-Term Hardening

1. Require signature permission — add a signature permission check to all exported activities
2. Validate widget ownership — ensure the calling UID matches the widget's host package
3. Remove automatic session rehydration from widget configuration flows; require explicit user authentication for session retrieval
4. Add rate-limiting to widget ID lookup to prevent brute-force attempts
5. Implement Android's AppWidgetManager binding checks — verify the caller has BIND_APPWIDGET permission before processing

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-44965
2. Datadog Security Advisories: https://security.datadoghq.com
3. Android App Widget Documentation (Google): https://developer.android.com/develop/ui/views/appwidgets
4. OWASP Mobile Security Testing Guide — Exported Activity Testing: https://owasp.org/www-project-mobile-security-testing-guide/
5. CWE-926 — Improper Export of Android Application Components: https://cwe.mitre.org/data/definitions/926.html

Threat Actor Campaigns

No known in-the-wild exploitation or threat actor campaigns targeting CVE-2026-44965 have been reported. The vulnerability requires local device access via a co-installed malicious application, which limits its utility for remote attackers. The vulnerability is currently unpatched and the vendor has not acknowledged the issue publicly. Security teams should monitor Datadog's security advisory page for patch announcements.