CVE-2026-85094 The Canva Android App before 2.376.0 did not restrict… — CVE Notify — TG.ME

CVCVE Notify@cveNotify · 19.7K subscribersOpen in TelegramOpen

🚨 CVE-2026-85094
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

🎖@cveNotify

Canva

Canva Trust & Security Portal | Powered by SafeBase

See how Canva manages their security program with SafeBase.

t.me/cveNotify/284943

1

September 4, 2026 71