The Datadog Android app version 5.9.2 contains a CWE-926 vulnerability where BubbleChatActivity is declared android:exported="true" without permission guards. It accepts SEND intents with mimeType text/plain and reads a conversation_id from the intent extras. On activity destruction, it calls BubbleChatNotification.dismiss, which unconditionally cancels notification ID 9201 (Bits AI chat notification) without validating the caller's identity or ownership of the conversation_id. This allows a zero-permission co-installed app to cancel the notification by launching BubbleChatActivity with any conversation_id. The vulnerability does not expose chat content as it is server-authenticated and not returned to the caller. The impact is confined to denial of the Bits AI chat notification, potentially causing nuisance or phishing risks.

The vulnerability allows an unprivileged app on the same device to cancel a specific Bits AI chat notification by exploiting the exported BubbleChatActivity without permission checks. There is no exposure of chat content or sensitive data. The primary impact is denial of the Bits AI chat notification, which could be used to disrupt user notifications or assist phishing attempts by removing legitimate notifications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about installing untrusted co-located applications that could exploit this behavior. The vendor has not provided an official fix or workaround at this time.