CVE-2026-85094

HighCVSS 8.8

Published: 04/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Summary

Canva Android App before version 2.376.0 did not restrict headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user's session.

Risk Assessment

An attacker can hijack a user's session, potentially leading to unauthorized access to the account and user data.

Recommendation

Update Canva app to version 2.376.0 or later, which includes the fix.

Other vulnerabilities in Canva Android App

CVE-2026-85085Critical
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

Original NVD description (English source)

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.