CVE-2026-85085

Name of the Vulnerable Software and Affected Versions Canva Android versions prior to 2.376.0

Description An issue exists where an external origin can be loaded within a privileged WebView, a component used to display web content inside a native application. This failure in the origin trust boundary allows a threat actor who controls the loaded page to communicate with the application using the user's session, potentially leading to session hijacking. The exploitation of this flaw requires user interaction.

Recommendations Update Canva Android to version 2.376.0 or later.