BubbleChatActivity in the Datadog Android application is exposed without a permission guard and accepts a SEND intent with text/plain MIME type. The activity reads a conversation_id from the intent and, upon destruction, calls BubbleChatNotification.dismiss, which unconditionally cancels notification ID 9201 – the hard‑coded Bits AI chat notification – without validating the caller’s identity or ownership of the supplied conversation_id. A zero‑permission, co‑installed application can therefore launch BubbleChatActivity with any fabricated conversation_id; when the activity terminates, the Bits AI chat notification is removed on the victim device. No data is leaked; the impact is limited to the denial of a specific in‑app notification, which might inconvenience users or facilitate phishing within app workflows.

Vendor Datadog; product Datadog Android App. No specific version details are provided by the advisory.

This vulnerability is likely exploitable by any locally installed, zero‑permission application that can send a SEND intent, as inferred from the exported activity. The attacker needs only to co‑install a small third‑party app that fires the intent; no network connection or elevated privileges are required. The EPSS score is unavailable and the vulnerability is not listed in the KEV catalog. Because the attack path is straightforward and does not rely on user interaction with the notification itself, the risk of automated exploitation is moderate, though the practical effect is confined to the removal of a single notification.