CVE-2026-47364

Executive Summary

CVE-2026-47364 affects the Datadog Android application and exposes a privacy vulnerability where the application automatically transmits a stable, per-user Datadog UUID to Firebase Crashlytics on every successful login. This identifier is coupled with the device's Firebase installation ID on Google's backend, and crash stack traces containing sensitive internal data (class names, in-flight data, breadcrumbs) are attached to that same UUID. The flaw is classified as CWE-200 (Exposure of Sensitive Information) and is currently UNPATCHED with no vendor fix available, no workarounds, and no CVSS score assigned. The core impact is a persistent cross-platform user correlation that undermines the anonymity of Datadog user identities and leaks potentially sensitive application internals to a third-party service without explicit user consent.

Technical Analysis

The vulnerability is rooted in the Datadog Android application's authentication and error-handling architecture. Upon successful login, the application invokes FirebaseCrashlytics.setUserId(), passing the signed-in user's Datadog UUID — a globally unique, immutable identifier assigned by Datadog's backend that remains constant across sessions, devices, and application reinstalls. This call executes automatically within the post-authentication code path without any visible consent gate or opt-out mechanism in the reviewed code.

Firebase Crashlytics, Google's crash-reporting service, stores this UUID and correlates it with the device's Firebase installation ID (an anonymous but unique device-level identifier). This dual-binding creates a persistent mapping: Datadog user UUID ↔ Firebase installation ID ↔ device. Any application crash subsequently logged via Crashlytics.recordException() attaches a full stack trace to this same user UUID. The stack trace may contain:

• Internal Java/Kotlin class names and package structure (revealing proprietary architecture)
• In-flight data referenced by crash frames (variables, object state, possibly tokens or user input)
• Breadcrumbs — chronological logs of user actions and navigation paths defined by the application

The data leak does not include personally identifiable information (no email, name, or organization data is forwarded in reviewed paths), but the aggregate exposure is significant: an attacker with access to the Firebase Crashlytics console (via leaked credentials, compromised Google account, or insider threat) can reconstruct a detailed activity profile per Datadog user UUID, correlating behavioral data with crash metadata in ways the user never consented to.

The attack surface is not the network stack but the data-collection layer of the mobile application itself. The vulnerability is a design flaw — the lack of privacy controls around third-party data forwarding — rather than a memory corruption or injection bug. Exploitation requires no network attack; it is triggered passively by normal application use (logging in and experiencing a crash). The exposure compounds over time: the longer the app is used, the more breadcrumbs and crash data accumulate under the UUID.

Exploitation Scenarios

While no public exploit code exists, an attacker can exploit CVE-2026-47364 through the following step-by-step chain:

1) Target Identification & Data Acquisition Access The attacker's first objective is gaining access to the Firebase Crashlytics console or its underlying BigQuery export. Attack vectors include:

• Phishing a Datadog Android app developer or QA engineer for their Google/Firebase credentials
• Exploiting a separate vulnerability in Firebase console authentication (e.g., credential stuffing against accounts with MFA disabled)
• Subverting an insider with console access
• Intercepting Crashlytics API traffic via a compromised mobile device or MITM on a rooted device to extract the firebase_session_identifier and user_id values

2) UUID Extraction & Correlation Once console access is achieved, the attacker queries the Crashlytics data:

• Runs a query filtering user_id IS NOT NULL to enumerate all Datadog UUIDs
• For each UUID, extracts the associated firebase_installation_id and collects crash groups, stack traces, and breadcrumb logs
• Uses the Firebase installation ID to cross-reference with other Google services (Firebase Analytics, Firebase Predictions) where the same installation ID may appear, enriching the profile

3) Profile Reconstruction The attacker aggregates per-UUID data to build activity fingerprints:

• Stack traces reveal class names → attacker maps them to Datadog's OAuth flows, network handlers, or local storage modules
• Breadcrumbs show user navigation patterns (e.g., "user opened settings", "user initiated password change")
• Crash frequency indicates application usage timing (time-of-day patterns, day-of-week patterns)
• If the same Datadog UUID appears in multiple app builds (beta + production), the attacker can identify individual testers

4) Post-Exploitation Impact With enriched profiles, the attacker can:

• Impersonate or target support flows: If breadcrumbs reveal a user performed a password reset, the attacker can time phishing attempts around known vulnerability windows
• Supply-chain pivoting: Crash data revealing internal class names helps tailor further exploits against the Datadog app itself
• Reputational damage: Public disclosure of UUID-to-behavior mapping undermines trust in Datadog's privacy posture

Impact Assessment

Confidentiality Impact: HIGH. Although no direct credential or PII exposure is documented, the aggregation of stable UUIDs, device identifiers, stack traces, and behavioral breadcrumbs constitutes a significant confidentiality breach. The data is forwarded to a third party (Google) without user consent, violating privacy expectations.

Integrity Impact: LOW. No data modification or injection is possible via this flaw alone.

Availability Impact: NONE. The vulnerability does not compromise service uptime.

CVSS Context: N/A — no score has been assigned. If scored, the vector would likely fall in the Medium–High range (4.0–8.9) depending on whether Firebase console compromise is considered a required "privilege" (lowering score) or if the lack of consent is treated as automatic exposure (raising score).

Affected Systems: All installations of the Datadog Android application that include Firebase Crashlytics integration and are used by authenticated users. Since no version range is published, systems running all current versions are presumed affected. The Datadog iOS app may have similar code patterns but is out of scope for this CVE.

Blast Radius: Any enterprise using Datadog Android monitoring agents (e.g., dd-sdk-android) on employee or customer devices. For MSSPs and large enterprises, the blast radius includes every authenticated mobile user whose crash data is archived on Google's infrastructure — a persistent, non-revocable data store.

Detection Guidance

Sigma Rule

title: Datadog Android - Firebase Crashlytics UUID Cross-Reference
id: 6f2e9a31-4c1b-4a8e-9d1c-5b3a2f7e8c90
status: experimental
description: Detects Android log entries where Datadog UUID is set as Crashlytics user ID, indicating automatic user tagging
logsource:
  product: android
  service: logcat
detection:
  selection_setUserId:
    - 'FirebaseCrashlytics.setUserId'
    - 'CrashlyticsCore.setUserId'
  selection_datadog:
    - '*datadog*' 
    - '*uuid*'
  condition: selection_setUserId and selection_datadog
falsepositives:
  - Legitimate app crash-reporting workflows (this is the normal behavior — flag only for audit)
level: low

YARA Rule

rule Datadog_Crashlytics_UUID_Exposure
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects Datadog Android APK bytecode or source containing automatic Crashlytics user-ID tagging"
        date = "2026-11-05"
        cve = "CVE-2026-47364"
    strings:
        $s1 = "FirebaseCrashlytics" ascii nocase
        $s2 = "setUserId" ascii nocase
        $s3 = "datadog" ascii nocase
        $s4 = "recordException" ascii nocase
        $s5 = "Datadog UUID" ascii nocase
    condition:
        ( uint16(0) == 0x4B53 or uint32(0) == 0x464F4C43 ) and // APK magic (PK or DEX)
        ( $s1 and $s2 and $s3 ) or ( $s4 and $s1 and $s5 )
}

Suricata IDS Rule

This vulnerability is mobile client-side with no network trigger. Detection is limited to monitoring Firebase Crashlytics traffic for anomalous UUID patterns.

alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2026-47364 - Crashlytics TLS with Datadog UUID in SNI or JA3 fingerprint correlation"; flow:to_server; tls.sni; content:"crashlytics"; nocase; sid:2026473641; rev:1; metadata:attack_target Mobile_Client, deployment Perimeter, tag CVE-2026-47364;)

Elastic Detection

// Match Android Logcat events on the host containing Crashlytics user-id setup
any where process.name == "logcat" and
  message : "*FirebaseCrashlytics.setUserId*" and
  message : "*datadog*"

Splunk SPL Query

index=android_logs sourcetype=logcat 
| search "FirebaseCrashlytics.setUserId" 
| rex field=_raw "(?<datadog_uuid>[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})"
| stats count by host, datadog_uuid 
| where count > 5
| table _time, host, datadog_uuid, count

Wazuh OSSEC Rule

<group name="android,privacy,">
  <rule id="100473" level="5" frequency="1">
    <decoded_as>json</decoded_as>
    <field name="log_type">logcat</field>
    <match>FirebaseCrashlytics.setUserId</match>
    <regex>datadog</regex>
    <description>Datadog Android: Crashlytics user-ID set to Datadog UUID without consent gate</description>
    <group>pci_dss_6.5.10,gdpr_art_5.1f,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (confidence 0/4). No vendor advisory, commit, or version fix has been identified across tracked sources. There is no patched version to upgrade to.

Immediate Mitigations (while waiting for vendor action):

1. Disable Firebase Crashlytics integration in the Datadog Android SDK build configuration. Remove FirebaseCrashlytics dependencies from the Gradle file or set CrashlyticsCore.setCrashlyticsCollectionEnabled(false) at app startup (note: this only stops future collection; previously uploaded data remains on Google's servers).
2. Isolate Datadog and Crashlytics dependencies in a separate build flavor for privacy-sensitive environments.
3. Audit existing Crashlytics data: For enterprise-managed Flutter/React Native wrappers around Datadog, pull all user_id values and correlate with known internal test accounts; request deletion of Crashlytics data via Google's data-deletion API.
4. Evaluate Data Loss Prevention (DLP): Ensure firm mobile device management policies block non-approved crash-reporting SDKs.

Patch/Upgrade Steps:

• Monitor Datadog's official changelog at https://github.com/DataDog/dd-sdk-android/releases for a security release.
• When a patched version (e.g., ≥ 2.x.y) is published, update the com.datadoghq:dd-sdk-android and com.datadoghq:dd-sdk-android-crash-reporting artifacts via Gradle:

  implementation ("com.datadoghq:dd-sdk-android-crash-reporting:2.x.y") {
      exclude group: 'com.google.firebase', module: 'firebase-crashlytics'
  }
  

• Validate the patch by searching the decompiled APK for setUserId calls absent behind an opt-in flag.

Long-Term Hardening:

1. Require opt-in consent before enabling any third-party crash-reporting SDK that tags user IDs. This is a GDPR/CCPA compliance gap.
2. Use ephemeral identifiers: Request Datadog to replace the stable UUID with a per-session random ID in Crashlytics forwarding.
3. Data-retention policies: Enforce Crashlytics retention limits (Google allows up to 90 days), ensuring historical UUID-to-device mappings expire.
4. Mobile app auditing: Add a routine review step in the CI/CD pipeline that flags any Crashlytics.setUserId call with a tainted (stable) identifier.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47364 (CWE-200, CVSS N/A, EPSS not scored)
2. Datadog Android SDK Repository: https://github.com/DataDog/dd-sdk-android — monitor for release notes/security advisories
3. Firebase Crashlytics Documentation – User IDs: https://firebase.google.com/docs/crashlytics/customize-crash-reports?platform=android#set-user-ids — demonstrates the setUserId mechanism exploited here
4. Mitre ATT&CK – Collection from Mobile Device (T1409): https://attack.mitre.org/techniques/T1409/ — relevant behavioral pattern for data harvesting from mobile endpoints
5. CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-47364 is NOT listed; no exploit-in-the-wild evidence exists as of this report

Threat Actor Activity: No active campaigns, exploit code, or weaponized tooling referencing CVE-2026-47364 has been observed in open-source intelligence or dark-web monitoring as of November 2026. The threat is inherent and passive — it requires no malicious action by the application user, only exploitation of the data already stored in Google's backend.