CVE-2026-85094

Canva / Canva PUBLISHED

Description (CNA)

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

Affected (CNA)

Vendor / product	Versions
Canva / Canva	affected 0 before 2.376.0

CWE

CWE-212

References

https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.