CVE-2026-47364 describes an information disclosure vulnerability in the Datadog Android app (version 5.9.2) where the app calls FirebaseCrashlytics.setUserId with the user's Datadog UUID on login. This stable identifier is meaningful within Datadog and is linked to the device's Firebase installation ID on Google's backend. Additionally, uncaught exceptions forwarded to Firebase Crashlytics include stack traces and breadcrumbs tied to this user UUID. The code paths reviewed do not show any consent gate or opt-out for this behavior. No direct personal identifiers like email, name, or organization data are forwarded. The vulnerability is classified as CWE-200 (Information Exposure). The app is a cloud service, and a patch is available, though specific patch details are not provided.

The vulnerability allows linking a stable Datadog user identifier with a device's Firebase installation ID, potentially exposing internal identifiers and crash data to Google's backend. This could lead to unintended information disclosure about user activity and internal app state. However, no direct personal information such as email or name is disclosed. There are no known exploits in the wild. The impact is primarily privacy-related due to information exposure.

A patch is available for this vulnerability. Since the product is a cloud service, Datadog manages remediation on their side. Users should update to the fixed version once available or follow vendor guidance. No explicit consent or opt-out mechanism was found, so users should verify updated app versions for improved privacy controls.