In versions of the Datadog Android application prior to v545‑5.9.2, OnCallNotificationActivity is declared exported without a permission guard. A co‑installed application can launch it with attacker‑controlled Intent extras, including a full‑screen lock‑screen message, an arbitrary on‑call page ID, and an arbitrary Intent to run inside the Datadog process. When the victim taps the Acknowledge button, the app sends a forged on‑call acknowledgement to the backend under the victim’s session, launches the attacker‑supplied Intent from within the Datadog process, causes the screen to turn on, and dismisses the keyguard. This results in unauthorized backend requests and potential lock‑screen manipulation, identified as CWE‑441.

Datadog Android App, running on Android devices with versions prior to v545‑5.9.2.

The vulnerability is exploitable only on devices that have the Datadog app installed and a user who remains logged in to the app. A malicious co‑installed application can invoke the exported activity directly, bypassing any permission checks. Because the attacker can send forged acknowledgements over the victim’s credentials, the risk is significant. The CVSS score is 6.5. No EPSS data is available, and KEV lists it as not listed, but the lack of a permission guard implies a high local exploitability.