CVE Catalog
CVE-2026-85085
CriticalCVSS 9.6Summary
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
Risk Assessment
Risk of session hijacking and unauthorized access to the user's Canva account, potentially leading to privacy breaches and data integrity issues.
Recommendation
Upgrade the Canva Android app to version 2.376.0 or later to prevent loading external content in a privileged WebView.
Other vulnerabilities in Canva Android App
Original NVD description (English source)
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.