Datadog Android CVE-2026-47363

Exploitation requires all of the following: (1) Datadog Android application installed on the victim's device in a version prior to 5.9.2; (2) a zero-permission co-installed malicious application on the same physical device, requiring social engineering or unrestricted sideloading capability - this is the primary limiting constraint; (3) the attacker must possess any valid Datadog OAuth access token not currently flagged as expired or expiring soon, including their own tokens - the session preparer's Ready path explicitly skips backend introspection under this condition, making the attacker's own credentials sufficient; and (4) the victim's device must permit installation of third-party applications outside an MDM allowlist. The exploit is not gated by any non-default Datadog application configuration - AppActivity is exported in all default installations of affected versions. Exploitation is bounded by the co-installation requirement, preventing remote network-based attacks without a prior device-level foothold or social engineering step. The OAUTH_OVERRIDE_TOKEN extra provides an additional capability to rotate persistent token storage but is not required for the base account-takeover scenario.

The provided CVSS vector of AV:N (network) directly conflicts with the described attack mechanism, which requires a malicious application to be co-installed on the victim's physical device - this is an AV:L (local) scenario. The score of 6.3 Medium likely underestimates actual impact: successful exploitation yields full OAuth session takeover with attacker-controlled tokens across confidentiality and integrity dimensions without any server-side validation opportunity. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. SSVC confirms exploitation as none and technical impact as partial, with automatable marked no - the co-installation prerequisite prevents scalable automated targeting. KEV status is absent, confirming no known active exploitation at time of analysis. Despite the medium CVSS label, the realistic risk is meaningfully elevated in enterprise Datadog deployments where monitoring accounts may have privileged access to infrastructure observability data, audit logs, and alert configurations. The co-installation constraint is the principal limiting factor; in environments permitting arbitrary app sideloading or lacking MDM controls, this constraint is substantially weaker.

An attacker distributes a zero-permission malicious application through social engineering or a third-party app store; once installed on the same device as Datadog, the app constructs an Android intent targeting com.datadog.app.AppActivity with Bundle extras containing the attacker's own valid Datadog OAuth access and refresh tokens under the com.datadog.app.* namespace keys. On intent delivery, the Datadog app deserializes the session, persists the attacker-controlled tokens to local storage, and automatically logs the victim into the attacker's Datadog organization - granting the victim's device access to the attacker's monitoring data - without contacting Datadog's backend for validation. No public exploit code has been identified at time of analysis.