CVE-2026-90860: High severity Canva Canva Mobile App for HarmonyOS vulnerability
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Canva Mobile App for HarmonyOSto a version that resolves this vulnerability.Fixed in v1.15.1 - Compensating control
Ensure the mobile app restricts the headers returned to an external origin running in a privileged WebView (so externally returned headers are not available to the WebView-controlled attacker).
Event History
Frequently Asked Questions
Who could exploit this issue?
An attacker would need control of a privileged WebView and would need to induce user interaction. The vulnerability is remotely reachable and requires no privileges on the affected app.
Which versions are affected?
Canva Mobile App for HarmonyOS versions before 1.15.1 are affected. Version 1.15.1 is not identified as affected in the provided information.
What could an attacker gain?
An attacker controlling the privileged WebView could access the user's session through headers returned to an external origin. The stated impact includes limited confidentiality impact and high integrity impact.