The Datadog Android application before version v545‑5.9.2 exported six widget configuration activities without permission checks. Each activity accepts a widget ID supplied by a caller and, if the ID matches a widget configured on the victim’s home screen, automatically loads the user’s locally cached Datadog session and renders live infrastructure data on the device’s display. Because the data are shown only on screen, the attacker can capture them only through a visual side channel such as screen recording, video capture, or accessibility‑based screenshot tools. This vulnerability corresponds to CWE‑926, an insecure direct object reference.

The issue affects the Datadog Android app on Android devices for all users who have installed a version earlier than v545‑5.9.2 and configured at least one of the six widgets: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, or DashboardWidgetActivity. Co‑installed applications on the same device can exploit the exported activities.

Exploitation requires a malicious application installed on the same device, at least one of the six exposed widgets present on the victim’s home screen, and an active locally cached Datadog session. The attacker can brute‑force the small sequential widget ID values to discover a matching widget without needing network access. The CVSS score of 5.5 indicates moderate severity; EPSS is not available, and the flaw is not listed in the CISA KEV catalog. Detection is difficult because the exposure is purely visual, and the primary risk is a confidentiality breach: an adversary can capture and view live operational data on the victim’s screen.