← Database

CVE-2026-85094

HIGH CVSS: 8.8 Published: 2026-09-04 Modified: 2026-09-08

Description

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

Affected Platforms

Unknown

Weakness Type

CWE-212

References