Canva Android App CVE-2026-85085

Exploitation requires the Canva Android App at a version below 2.376.0 and requires the victim to load an attacker-controlled external page inside the app's privileged WebView (UI:R) - the attacker must control the content of the page the user opens. No authentication of the attacker is needed (PR:N), but the victim must have an active Canva session for the attacker to abuse it. Limiting factors: it only affects the Android client prior to 2.376.0, depends on user interaction to open malicious content, and yields access scoped to the victim's own session rather than server-side or other users' data.

The CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) is high, driven by network vector, no privileges required, a scope change (web content crossing into the app's trust boundary), and high confidentiality/integrity impact. The critical limiting factor is UI:R - the victim must be induced to open an attacker-controlled page in the app, so this is a targeted, social-engineering-dependent attack rather than a wormable remote exploit. There is no EPSS value, KEV listing, or POC in the provided data, so exploitation appears theoretical/vendor-reported rather than observed in the wild. The A:L (availability) component is weakly supported by the description, which focuses on session abuse (confidentiality/integrity) rather than any denial of service - verify with vendor. Overall this is a genuinely serious client-side flaw in a very widely installed app, but real-world exploitation hinges on tricking users into loading malicious content.

An attacker sends a Canva user a link (via email, chat, or a shared design) that, when opened in the vulnerable app, loads an attacker-controlled page inside the privileged WebView. The page then issues requests to Canva using the victim's active session, exfiltrating designs/account data or performing actions as the user. No public POC is currently identified, and the attack requires the victim to open the malicious content.