The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. (CVE-2026-85085)

The Canva Android App versions prior to 2.376.0 contain a vulnerability (CVE-2026-85085) where an external origin can be loaded within a privileged WebView component. This allows an attacker who controls the content of the loaded page to interact with the Canva app using the victim's session, effectively bypassing security boundaries. The vulnerability is classified under CWE-940 and has a CVSS 3.1 score of 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and high impact on confidentiality and integrity with low impact on availability.

An attacker who can control the external page loaded in the vulnerable WebView can leverage the user's session to communicate with Canva, potentially accessing sensitive user data or performing unauthorized actions within the app context. This compromises the confidentiality and integrity of the user's Canva account and data, with some impact on availability.

A fix is available in Canva Android App version 2.376.0 and later. Users and administrators should update to version 2.376.0 or newer to remediate this vulnerability. Since this is a client application vulnerability, patching the app is required to mitigate the risk.