CVE-2026-85094
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Sep 04, 2026
Vendor
unknown
Description
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.