CVE-2026-85094 — HIGH (8.8)

Vulnerability Description

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-212

References

https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a

FAQ

What is CVE-2026-85094?

CVE-2026-85094 is a vulnerability with a CVSS score of 8.8 (HIGH). The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s sess...

How severe is CVE-2026-85094?

CVE-2026-85094 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-85094?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.