CRITICAL 9.6 NVD

CVE-2026-85085

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

References

https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a

Published: 2026-09-04 · Source: NVD · Feed updated: 2026-09-04

This critical severity vulnerability with a CVSS score of 9.6 was published on 2026-09-04 via NVD.

Risk Timeline

CVE Disclosed2026-09-04 · -1 days ago

Remediation Resources

Analysis & PoC

trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a

vulnfeed aggregates 8132 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.