The Datadog Android app version 5.9.2 has six exported widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) that lack permission protection. These activities inherit from a base WidgetActivity that uses an Intent extra (EXTRA_APPWIDGET_ID) to identify widgets and automatically log in using the associated user session. A malicious co-installed app can brute-force these widget IDs to find configured widgets on the victim device, causing the activity to load the victim's session and display live data. Data exfiltration is limited to visual side channels such as screen recording or accessibility services, as no programmatic data return is possible. Exploitation requires a malicious app on the device, at least one configured widget, and an active cached Datadog session.

An attacker with a zero-permission malicious app co-installed on the victim's device can access the Datadog app's widget configuration activities and cause them to load the victim's authenticated session data. Although direct programmatic data exfiltration is not possible, the attacker can visually capture sensitive information through screen recording, screenshots, or accessibility services. This leads to potential unauthorized disclosure of live monitoring data, incident details, and on-call information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing untrusted applications alongside the Datadog Android app and consider removing configured widgets if possible to reduce exposure. Monitor vendor communications for updates on official patches or mitigations.