Canva Android App CVE-2026-85094

Exploitation requires that a threat actor achieve control over an external origin loaded inside Canva's privileged Android WebView. Viable attack paths include serving a malicious page linked from within the Canva app, performing a MITM on content fetched by the privileged WebView, or abusing any in-app deep link or URL handler that loads attacker-controlled content in the elevated context. The victim must be running an unpatched Canva Android version prior to 2.376.0 and must interact with the app in a manner that causes the privileged WebView to load the attacker's origin (UI:R per CVSS). The vulnerability is not exploitable against iOS, web, or desktop Canva clients, and the attacker requires no prior authentication from the victim's account.

The provided CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this as High severity; the C:H and I:H components are well-grounded given that session token theft enables full account takeover with read and write access to the victim's Canva workspace. The A:H metric is less clearly supported - header exposure and resultant session hijacking do not inherently cause direct availability loss, so the Availability impact appears overstated unless deliberate account lockout by the attacker is included in scope. Exploitation requires user interaction (UI:R) and an attacker who can position malicious content in the privileged WebView, raising the practical bar slightly above a pure-network, zero-interaction attack; even a mid-sized design team relying on Canva in radom should treat patching to v2.376.0 as urgent given the low complexity of exploitation once the WebView interaction occurs. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the EPSS signal is unavailable from the supplied data, leaving exploitation probability uncertain but the potential impact clearly high.

An attacker positions a malicious external webpage to be loaded within Canva's privileged Android WebView - for example via a phishing link opened inside the Canva app or through a MITM intercept on content the WebView fetches. Because the app does not restrict which headers are accessible to the external origin, the attacker's server receives the user's session token reflected in the headers. The attacker replays this token against Canva's APIs, achieving full authenticated access to the victim's account and all associated design assets.