> CVE-2026-47364

« BACK_TO_HOME
PUBLISHED
2026-08-07 18:17
MODIFIED
2026-08-07 18:17
EPSS (Prob. Exploit)
0.44%
Top 61.9%
DATA SOURCES:
NVD 🔗 2026-08-07 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01

> DESCRIPTION

On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID. No visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-200

> CWE DETAILED DESCRIPTIONS

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

> HISTORIQUE DES MODIFICATIONS

Première apparition
07/08/2026 18:17
Source: NVD
📊 ENRICHISSEMENT 01/09/2026 06:02
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Total des modifications: 1 Dernière mise à jour: 2 months ago

> REFERENCES

https://cwe.mitre.org/data/definitions/200.html
https://firebase.google.com/docs/crashlytics/customize-crash-reports?platform=an...
https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef
« BACK_TO_HOME