Canva Mobile App EUVD-2026-83843

Exploitation requires the attacker to control the content loaded in the app's privileged WebView and the victim to be a logged-in Canva user on the HarmonyOS app before v1.15.1; the app must load an external/attacker origin in that privileged WebView context. The limiting factors are: victim interaction is needed (UI:R) to load the malicious content, the attacker cannot succeed against a defaulted/closed WebView unless external origins can be surfaced, and only the HarmonyOS build below v1.15.1 is affected - iOS/Android and patched versions are out of scope. There is no server-side or unauthenticated-of-the-victim shortcut; the session belongs to the interacting user.

This is a real but conditional risk rather than a mass-exploitation priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N = 7.1) rates it High, but the impact metrics look internally inconsistent with the described outcome: gaining access to a user's session is fundamentally a confidentiality-then-impersonation issue, so C:L understates it (a captured session grants full account access, arguing C:H) while the AC:L rating understates the real precondition - the attacker must already control the content of a privileged WebView, which is not a trivially met condition. No EPSS score, KEV listing, or public POC is present in the provided data, so all three widespread-exploitation signals are absent: this reads as a defense-in-depth mobile-client hardening fix, not an actively exploited flaw. The only reference is a Canva trust-center URL (surfaced via NVD), so there is no independent corroboration of exploitation or of the exact attack complexity. Net: patch-worthy for HarmonyOS Canva users, but not an emergency; treat as targeted/theoretical until a POC or telemetry says otherwise.

A HarmonyOS Canva user is lured into loading attacker-controlled content inside the app's privileged WebView (e.g., via a crafted link or embedded external origin). Because the app fails to restrict which response headers are exposed to that external origin, the attacker's script reads session-bearing headers and hijacks the authenticated Canva session. No public exploit code is identified at time of analysis, and success depends on the victim interacting with the malicious WebView content (UI:R).