CVE-2026-85085

Canva / Canva PUBLISHED

Description (CNA)

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

Affected (CNA)

Vendor / product	Versions
Canva / Canva	affected 0 before 2.376.0

CWE

CWE-940

References

https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.