The Datadog Android app (version 5.9.2) contains a CWE-441 Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in the OnCallNotificationActivity, which is declared android:exported="true" without permission guards. A malicious co-installed app can launch this activity with attacker-controlled Intent extras, causing three main effects after a user tap: (1) a forged Acknowledge request is sent to the Datadog backend using the victim's authenticated session and attacker-chosen page_id; (2) the attacker-controlled Intent is launched from within the Datadog process, enabling access to non-exported components; (3) the device keyguard is dismissed and the screen is turned on, potentially facilitating social engineering or annoyance. This requires a malicious app on the device and an active Datadog session. No CVSS score or vendor remediation information is currently available.

An attacker with a malicious app on the same device can abuse the exported OnCallNotificationActivity to send unauthorized Acknowledge requests to the Datadog backend using the victim's authenticated session, potentially manipulating on-call notifications. The attacker can also launch arbitrary Intents within the Datadog app context, gaining access to non-exported components, and dismiss the device keyguard while turning on the screen, which may be used for social engineering or user annoyance. This compromises the integrity of on-call notification acknowledgments and may affect user trust and device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid installing untrusted applications alongside the Datadog Android app and consider restricting app permissions where possible to limit co-installed app capabilities. Monitor official Datadog channels for updates regarding a fix or mitigation.