CVE-2026-85085: Critical severity Canva Canva Android App vulnerability
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Users of the Canva Android App versions before 2.376.0 are affected if they load an externally controlled page in the app's privileged WebView.
What must an attacker do to exploit the vulnerability?
The attacker must control the page that the user loads. Exploitation also requires user interaction, as reflected by the UI:R vector.
What could an attacker gain through successful exploitation?
An attacker-controlled page can communicate with Canva using the affected user's session. The reported impact includes high confidentiality and integrity impact, with low availability impact.
How can I remediate this issue?
Update the Canva Android App to version 2.376.0 or later. The issue affects versions before 2.376.0.