CVE-2026-85085
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
Risk Assessment
Risk of session hijacking and unauthorized access to the user's Canva account, potentially leading to privacy breaches and data integrity issues.
Recommendation
Upgrade the Canva Android app to version 2.376.0 or later to prevent loading external content in a privileged WebView.
Other vulnerabilities in Canva Android App
Original NVD description (English source)
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS