CVE-2026-85085

Published: Sep 4, 2026Modified: Sep 4, 2026

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Exploitability: 2.8 / Impact: 6.0

Source: 61adb53e-e4b3-47f7-8a93-4717c9e77dc6 (Secondary)

Description

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

Related CWEs

CWE-940

Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (1)

https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a

Source: 61adb53e-e4b3-47f7-8a93-4717c9e77dc6

Timeline

No history available yet.