CVE-2026-85085

The Canva Android App (versions before 2.376.0 ) contained a vulnerability in a privileged WebView that allowed an external origin to be loaded. A threat actor who controls a page visited by the user can communicate with Canva using the user's session, enabling high confidentiality and integrity ...