Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Canva Android app may expose user session to malicious page

CVE-2026-85085 · published 2 months ago
Summary

Older versions of the Canva Android app let any web page load in a privileged view, so an attacker who controls that page can interact with the app using the logged‑in user's session. This could allow the attacker to view or modify the user's designs and data. Update the app to version 2.376.0 or later to fix the issue.

What to do
  • Update canva canva to version 2.376.0 or later.
Affected software
VendorProductAffected versions
canva canva < 2.376.0
Original advisory text
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using...
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.6 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-940Improper Verification of Source of a Communication Channel
Timeline
Published4 Sep 2026
Updated4 Nov 2026
First seen4 Sep 2026
Sources
CVE-2026-85085 · NVD
CVE-2026-85085 · MITRE
Track software like this
Free during beta