Answer in brief
CVE-2026-47361 records a Unknown severity vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps Datadog/Android App (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Datadog/Android App (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Datadog/Android Appgeneric | >=5.9.2 <5.9.2 | 5.9.2 |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss whenever no active in-process session matches the caller-supplied conversation_id. BubbleChatNotification.dismiss unconditionally cancels notification ID 9201 — the hard-coded Bits AI chat notification — using NotificationManager.cancel, with no validation of the caller's identity or ownership of the supplied conversation_id. A zero-permission co-installed application can therefore launch BubbleChatActivity with any random conversation_id; when the activity is finished, the Bits AI chat notification is cancelled on the victim device. No data exposure: chat content is server-authentication gated and is never returned to the caller. Shortcut removal is scoped to the attacker-supplied conversation ID, which is a random string and is not reachable without prior knowledge. Impact is confined to denial of the Bits AI chat notification (a nuisance and a potential aid to phishing of in-app workflows).
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-47361 records a Unknown severity vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps Datadog/Android App (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Datadog/Android App (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Datadog/Android Appgeneric | >=5.9.2 <5.9.2 | 5.9.2 |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and accepts a SEND intent with mimeType text/plain. The activity reads a conversation_id from Intent extras and, on onDestroy, calls BubbleChatNotification.dismiss whenever no active in-process session matches the caller-supplied conversation_id. BubbleChatNotification.dismiss unconditionally cancels notification ID 9201 — the hard-coded Bits AI chat notification — using NotificationManager.cancel, with no validation of the caller's identity or ownership of the supplied conversation_id. A zero-permission co-installed application can therefore launch BubbleChatActivity with any random conversation_id; when the activity is finished, the Bits AI chat notification is cancelled on the victim device. No data exposure: chat content is server-authentication gated and is never returned to the caller. Shortcut removal is scoped to the attacker-supplied conversation ID, which is a random string and is not reachable without prior knowledge. Impact is confined to denial of the Bits AI chat notification (a nuisance and a potential aid to phishing of in-app workflows).
Quoted source text, attributed separately from HOL analysis.