CVE-2026-47361 Datadog CVE debrief

Who should care

Users of the Datadog Android application, particularly those with sensitive information, should be aware of this vulnerability and take steps to protect themselves. This includes updating to the latest version of the application, restricting the installation of applications to trusted sources, and monitoring for suspicious activity related to the Bits AI chat notification. Additionally, security teams should review system logs and perform regular security audits to identify potential vulnerabilities.

Technical summary

The Datadog Android application prior to v541-5.9.2 has a vulnerability where a co-installed application can silently dismiss the victim's Bits AI chat notification. This is due to the BubbleChatActivity being exported with no permission guard and accepting a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation.

Defensive priority

Medium priority due to the requirement of a co-installed malicious application.

Recommended defensive actions

• Verify the Datadog Android application version and update to v541-5.9.2 or later.
• Restrict the installation of applications to trusted sources.
• Monitor for suspicious activity related to the Bits AI chat notification.
• Review system logs for potential security incidents.
• Perform regular security audits to identify potential vulnerabilities.
• Implement additional security measures to protect sensitive information.
• Consider using compensating controls for exposed systems.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Datadog Android application versions prior to v541-5.9.2. The vulnerability allows a co-installed application to silently dismiss the victim's Bits AI chat notification. To verify, defenders should check the application version and review system logs for suspicious activity related to the Bits AI chat notification. Additionally, defenders should be aware of the potential impact and take steps to protect sensitive information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.