In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported without a permission guard and accepts a SEND intent carrying a caller‑supplied conversation_id. When the activity terminates and no in‑process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification) without verifying the caller’s identity or ownership of the conversation. A malicious co‑installed application can therefore launch this activity, causing the notification to disappear silently. No chat content is exposed; conversation data remains server‑authenticated and is never returned to the caller, so the impact is limited to the loss of the notification, which can inconvenience users or potentially aid phishing attempts within app workflows.

Vendor Datadog; product Datadog Android App. All releases prior to v541‑5.9.2 are affected; the vulnerability is fixed in v541‑5.9.2 and subsequent versions.

This vulnerability is likely exploitable by any locally installed, zero‑permission application that can send a SEND intent, as inferred from the exported activity. The attacker needs only to co‑install a small third‑party app that fires the intent; no network connection or elevated privileges are required. The EPSS score is unavailable and the vulnerability is not listed in the KEV catalog. Because the attack path is straightforward and does not rely on user interaction with the notification itself, the risk of automated exploitation is moderate, though the practical effect is confined to the removal of a single notification.