The Datadog Android application distributes the users’ Datadog UUID to Firebase Crashlytics after a successful login. The UUID is a stable, per-user identifier that has meaning only inside Datadog. Firebase Crashlytics attaches this identifier to device crash data, including stack traces that may contain internal class names, package names, and in-flight data. No email, name, or organization data is sent, but the association of a Datadog UUID with a device’s Firebase installation ID creates a linkable identifier that could be used to track or profile users across services. The core weakness is an information disclosure (CWE-200).

This flaw affects the Datadog Android application. All installations that retrieve Firebase Crashlytics and do not provide a user opt-out or consent gate are impacted. No specific version details are listed, so all currently supported app releases are potentially susceptible until a patch or configuration change removes the data path.

The risk is limited to the exposure of a stable identifier; it does not provide code execution or data modification capability. The likelihood of exploitation depends on how often crash reports are analyzed on Firebase’s side and whether the data is shared externally. Because no exploit vector or public exploit is reported, the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the privacy impact warrants scrutiny, especially in environments that require strict data minimization and consent management.