CVE-2026-47361

BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss whenever no active in-process session matches the caller-supplied conversation_id. BubbleChatNotification.dismiss unconditionally cancels notification ID 9201 — the hard-coded Bits AI chat notification — using NotificationManager.cancel, with no validation of the caller's identity or ownership of the supplied conversation_id. A zero-permission co-installed application can therefore launch BubbleChatActivity with any random conversation_id; when the activity is finished, the Bits AI chat notification is cancelled on the victim device. No data exposure: chat content is server-authentication gated and is never returned to the caller. Shortcut removal is scoped to the attacker-supplied conversation ID, which is a random string and is not reachable without prior knowledge. Impact is confined to denial of the Bits AI chat notification (a nuisance and a potential aid to phishing of in-app workflows).

Scoring

Severity
MEDIUM
CVSS base score
6.4
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS probability
0.17%
CWE
CWE-926
Published
2026-08-07
Last modified
2026-08-08

Affected products

Weakness type

Related vulnerabilities

Markdown version · Browse all CVEs