CVE-2026-47363

Executive Summary

CVE-2026-47363 is a critical Android application-level vulnerability in the Datadog mobile client. The launcher activity (AppActivity) is exported without permission guards and performs unvalidated deserialization of a UserSession object from Intent extras, allowing any co-installed zero-permission application on the victim device to inject arbitrary authentication credentials (including OAuth access and refresh tokens). The Datadog app then persists the attacker-supplied session, optionally rotates the token storage, and performs an automatic login without server-side token validation. This results in full session hijacking, identity spoofing, and unauthorized access to the victim's Datadog account using attacker-controlled credentials. All Android devices with the Datadog application installed are potentially affected. The vulnerability carries a high business impact due to the sensitivity of Datadog telemetry data, which typically includes production system metrics, logs, traces, and infrastructure details.

Technical Analysis

The root cause of CVE-2026-47363 resides in the Android component declaration and the startup pipeline of the Datadog Android SDK. The AppActivity launcher is declared in the application manifest with the attributes android:exported="true" and android:launchMode="singleTask". The combination of these two attributes is inherently dangerous: an exported activity can be invoked by any application on the device, and singleTask ensures the activity is reused if it exists, preserving the task's intent stack.

The vulnerability is triggered in the onCreate() and onNewIntent() lifecycle callbacks of AppActivity. Both methods call Intent.getUserSession(), an extension function that performs deserialization of a UserSession data class from Bundle extras. The keys used for extraction are namespaced under the com.datadog.app.* prefix. Critically, this extension is implemented in the main sourceset of the SDK, not in a test-only sourceset—a misleading code comment referencing "internal test fixtures" suggests the code was accidentally promoted from test utilities to production code.

The UserSession object deserialized from the Intent extras contains the following sensitive fields:

• User identity (username, email, user ID)
• OAuth access token
• OAuth refresh token
• Datadog host URL
• Organization identifier
• Datacenter specification
• User permissions

Once the session object is constructed, it is passed to the startup pipeline. The session preparer component validates the access token by checking a local flag for expiration—not by contacting the Datadog backend. If the injected access token is not flagged as expired or expiring soon, the session preparer returns Ready, and the pipeline proceeds to:

1. Persist the injected session to the device's user storage (SharedPreferences or equivalent).
2. If an OAUTH_OVERRIDE_TOKEN extra is present, rotate the persisted token storage.
3. Perform an automatic login under the attacker-chosen identity.

The exported activity combined with the absence of a permission guard means no runtime permission (e.g., signature-level permission) is required for the malicious application to invoke AppActivity with the crafted Intent extras.

The attack vector is local (adjacent to the device), but the attack surface is broad: any third-party application installed on the device—even one requesting zero permissions—can exploit this flaw. The CWE classification is CWE-926 (Improper Export of Android Application Components).

Exploitation Scenarios

Scenario 1 — Token Injection and Session Hijacking:

1. Reconnaissance: The attacker identifies a target device with the Datadog Android application installed. This can be determined by querying the PackageManager for the Datadog package name (e.g., com.datadog.app).

2. Weaponization: The attacker creates a malicious Android application that requires zero permissions. The app code constructs an Intent with the following attributes:

   • ComponentName set to the Datadog AppActivity
   • ACTION_MAIN with CATEGORY_LAUNCHER
   • Extras bundle containing the keys com.datadog.app.user_session with a serialized UserSession object, or the individual extra keys (com.datadog.app.access_token, com.datadog.app.refresh_token, com.datadog.app.host, com.datadog.app.org, com.datadog.app.datacenter, and OAUTH_OVERRIDE_TOKEN).

3. Payload Execution: The malicious app calls startActivity(intent) with the crafted intent, and sets FLAG_ACTIVITY_NEW_TASK if required. The Datadog AppActivity is launched, onCreate or onNewIntent fires, and the getUserSession() extension deserializes the injected extras.

4. Post-exploitation Impact: The Datadog app persists the injected token, auto-logs in, and the attacker now controls the identity seen by the Datadog backend. The attacker can then use their own OAuth token (which they control) to access the victim's Datadog console via the web, viewing all telemetry data (system logs, application traces, infrastructure metrics) that the victim's mobile app would normally send.

Scenario 2 — Token Storage Rotation Attack:

In a more severe variant, the attacker includes the OAUTH_OVERRIDE_TOKEN extra. This forces the persisted token storage to be rotated, meaning the victim's legitimate Datadog OAuth tokens are overwritten with the attacker's token. The victim's next auto-login will use the attacker's credentials, and the attacker can revoke their own token to cause a denial-of-service or lockout condition for the victim.

Scenario 3 — Data Exfiltration via Session Modification:

The attacker modifies the host and datacenter fields in the injected session to point to an attacker-controlled endpoint. The Datadog app then sends telemetry data (metrics, logs, traces) to the attacker's server, inadvertently exfiltrating sensitive production data collected by the SDK from the device and any connected systems.

Impact Assessment

The business impact of CVE-2026-47363 is High, despite the local attack vector. Datadog is an observability platform, and the mobile application typically provides access to dashboards, monitors, and alerting for production systems. A compromised session allows the attacker to:

• View sensitive infrastructure data, including server IPs, cloud provider details, and application internals.
• Trigger false alerts or dismiss real alerts, causing operational disruption.
• Manipulate monitors and dashboards if the session carries escalated permissions.
• Gain a foothold for lateral movement if the Datadog account is linked to SSO/SAML with organizational trust.

The attack requires the victim to have the Datadog app installed and a co-installed malicious application. The attacker must possess a valid (non-expired) OAuth access token—which can be the attacker's own token from a trial account. This significantly lowers the barrier to entry. The CVSS score is not yet assigned (N/A), but the vulnerability class (CWE-926 with session injection) typically scores between 7.0 and 8.9 (High) when factoring in confidentiality, integrity, and availability impacts.

Blast radius: All Android devices with the Datadog app installed and the affected SDK version. iOS and other platforms are not affected by this specific flaw.

Detection Guidance

Sigma Rule

The Sigma rule below detects suspicious Android Intents targeting the Datadog exported activity with session-related extras. Since Sigma rules are typically used for host/EDR telemetry, this rule targets Android device logging (Logcat) or mobile device management (MDM) endpoint telemetry.

title: Datadog Android AppActivity Exported Intent Injection
id: 68df2c1b-4f47-4fd7-9f5a-c4f98a2d7e41
status: experimental
description: Detects attempts to invoke the exported Datadog AppActivity with injected UserSession extras.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47363
author: VALTERS IT Threat Intelligence
date: 2026/06/15
logsource:
    category: process_creation
    product: android
detection:
    selection_intent:
        EventID: 'startActivity'
        Component: 'com.datadog.app/.AppActivity'
    selection_extras:
        IntentExtras|contains:
            - 'OAUTH_OVERRIDE_TOKEN'
            - 'com.datadog.app.access_token'
            - 'com.datadog.app.user_session'
            - 'com.datadog.app.host'
    condition: selection_intent and selection_extras
level: critical
falsepositives:
    - Legitimate Datadog deep-linking features (if any exist; none documented publicly)
tags:
    - attack.t1546.001
    - attack.t1565
    - cve.2026.47363
    - cwe.926

YARA Rule

The YARA rule below scans Android DEX bytecode for the dangerous getUserSession() extension and the exported activity intent handling code—useful for malicious app detection in app stores or static analysis triage.

rule Datadog_AppActivity_Session_Injection_CVE_2026_47363 {
    meta:
        author = "VALTERS IT Threat Intelligence"
        description = "Detects Android DEX bytecode referencing Datadog AppActivity exported intent injection"
        reference = "CVE-2026-47363"
        date = "2026-06-15"
        severity = "critical"
    strings:
        $s1 = "com.datadog.app.AppActivity" ascii wide
        $s2 = "getUserSession" ascii wide
        $s3 = "OAUTH_OVERRIDE_TOKEN" ascii wide
        $s4 = "com.datadog.app.access_token" ascii wide
        $s5 = "com.datadog.app.user_session" ascii wide
        $s6 = "android:exported=\"true\"" ascii wide nocase
        $s7 = "startActivity" ascii wide
    condition:
        uint32(0) == 0x464c457f and (  // ELF magic for DEX/ODEX files
            (2 of ($s1, $s2, $s3, $s4, $s5)) and
            ($s6 or $s7)
        ) or (
            filesize < 20MB and
            3 of ($s1, $s2, $s3, $s4, $s5)
        )
}

Suricata IDS Rule

Since this vulnerability is local to the Android device, network-level detection focuses on anomalous connections initiated by the Datadog app to unexpected hosts (indicative of host/datacenter field manipulation or credential reuse). The rule below detects Datadog app traffic to non-standard datacenter IPs or unusual TLS SNI.

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-47363 Datadog App Anomalous TLS SNI - Possible Session Injection"; flow:to_server,established; tls.sni; content:"datadoghq.com"; sid:2026047363; rev:1; metadata:created_at 2026_06_15, updated_at 2026_06_15, cve CVE-2026-47363; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-47363;)

Note: This rule flags connections where the Datadog app contacts an endpoint that is not a known Datadog datacenter, which could indicate the attacker modified the host field. For a more precise rule, maintain a list of legitimate Datadog endpoints and alert when the SNI differs.

Elastic Detection

The following Elastic EQL query detects anomalous process/activity events on Android devices where the Datadog app launches its AppActivity with session extras from an unexpected caller (a third-party app). This is event-based detection.

sequence by device.id
  [process where event.action == "start" and process.name == "datadog.app" and
     process.args : "*AppActivity*"]
  [process where event.action == "start" and
     process.parent.name != null and process.parent.name != "datadog.app" and
     process.args : ("*OAUTH_OVERRIDE_TOKEN*", "*com.datadog.app.access_token*", "*com.datadog.app.user_session*")]

Splunk SPL Query

The Splunk query below searches mobile device management (MDM) logs or Android Logcat exports for startActivity events targeting Datadog AppActivity with session extras.

index=android_logs OR index=mdm
| search EventCode=startActivity OR activity=startActivity
| search Component="com.datadog.app/.AppActivity"
| search IntentExtras IN ("*OAUTH_OVERRIDE_TOKEN*", "*com.datadog.app.access_token*", "*com.datadog.app.user_session*", "*com.datadog.app.host*")
| rename src_user AS "Attacker App", dest_user AS "Datadog App"
| eval severity="critical"
| table _time, src_user, dest_user, Component, IntentExtras, device_id
| sort - _time

Wazuh OSSEC Rule

The Wazuh rule below detects Android Logcat entries showing Datadog AppActivity launches combined with session deserialization attempts, using the Syslog/Logcat integration.

<group name="android,datadog,cve-2026-47363,">
  <rule id="100736" level="15">
    <decoded_as>json</decoded_as>
    <field name="tag">ActivityTaskManager</field>
    <match>com.datadog.app</match>
    <regex>Displayed com.datadog.app/.AppActivity</regex>
    <description>Datadog AppActivity launched on device - possible CVE-2026-47363 exploitation attempt</description>
    <group>cve-2026-47363,</group>
    <mitre>
      <id>T1546.001</id>
    </mitre>
  </rule>
  <rule id="100737" level="15">
    <if_sid>100736</if_sid>
    <regex>OAUTH_OVERRIDE_TOKEN|com.datadog.app.access_token|com.datadog.app.user_session</regex>
    <description>Datadog AppActivity launched with injected UserSession extras - CVE-2026-47363 exploitation confirmed</description>
    <group>cve-2026-47363,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or patched version has been identified in any tracked advisory source at the time of writing.

Immediate Mitigations:

1. Remove or disable the Datadog Android mobile app on enterprise-managed devices until a patch is released. If the app is not essential for daily operations, this is the most effective mitigation.
2. Implement app allowlisting on managed devices (e.g., via Android Enterprise, Intune, or Workspace ONE) to prevent installation of unknown third-party applications. This reduces the likelihood of a malicious app being co-installed with the Datadog app.
3. Restrict installation sources to the Google Play Store only and disable sideloading on managed devices.
4. Monitor device logs for anomalous startActivity events targeting the Datadog app (using the detection rules above).
5. Review and revoke session tokens periodically for Datadog mobile app users. If tokens are suspected of being rotated, revoke them in the Datadog web console.

Patch/Upgrade Steps:

1. Monitor Datadog's official security advisories and the Android SDK release notes for a fix.
2. When a patched version of the Datadog Android application is released, deploy it immediately via your MDM solution.
3. Post-patch, verify that AppActivity is either no longer exported, has a signature-level permission guard, or no longer deserializes session data from Intent extras.

Long-Term Hardening:

1. Vendor-side: Datadog must move the getUserSession() extension out of the main sourceset into a dedicated test fixtures module that is not packaged in the release APK. The AppActivity must be declared android:exported="false" or guarded with a signature permission. Additionally, the session preparer should enforce server-side token introspection before accepting any auto-login.
2. Customer-side: Enforce MDM policies that require app permissions review and runtime permission monitoring. Deploy a mobile threat defense (MTD) solution that can detect and block intent injection attacks.
3. Proactive Security: For Android apps, implement a security static-analysis gate in the CI/CD pipeline that fails builds when an exported component handles sensitive deserialization without a permission check.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47363
2. Datadog Security Advisories (vendor): https://www.datadoghq.com/security/ (monitor for CVE-2026-47363 related updates)
3. MITRE ATT&CK: https://attack.mitre.org/techniques/T1546/001/ (Event Triggered Execution)
4. CWE-926 Reference: https://cwe.mitre.org/data/definitions/926.html (Improper Export of Android Application Components)
5. No known threat actor campaigns or exploit-in-the-wild evidence are currently documented for CVE-2026-47363. The CISA KEV catalog does not list this CVE.