EUVD-2026-70914
GHSA-97f3-2864-45mw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Attacker-controlled page in a privileged WebView acts with the victim's session (C:H/I:H, S:C) but requires the user to load it (UI:R); no availability impact is evidenced, so A:N.
Primary rating from Vendor (Canva).
CVSS VectorVendor: Canva
Lifecycle Timeline
4DescriptionCVE.org
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
AnalysisAI
Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva application using the victim's authenticated session because an external origin could be loaded inside a privileged WebView (CWE-940). A threat actor who lures a user into loading a malicious page can send requests to Canva as the user, reading and modifying account data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Canva Android App at a version below 2.376.0 and requires the victim to load an attacker-controlled external page inside the app's privileged WebView (UI:R) - the attacker must control the content of the page the user opens. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) is high, driven by network vector, no privileges required, a scope change (web content crossing into the app's trust boundary), and high confidentiality/integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Canva Android App to version 2.376.0 or later, which restores proper origin verification for the privileged WebView (Vendor-released patch: 2.376.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Issue urgent security advisory warning Canva Android app users to force logout and use web/desktop clients instead; alert Canva to prioritize patch development. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in
A type confusion vulnerability in the EMF (Enhanced Metafile) functionality of Canva Affinity allows attackers to achiev
An out-of-bounds write vulnerability in Canva Affinity's EMF file processing allows attackers to achieve code execution
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, al
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allow
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attacke
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, af
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affec
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affec
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today