- The Mess: Canva’s Android app had two fresh vulnerabilities that let attacker-controlled web content interact with a privileged WebView and access the user’s Canva session. CVE-2026-85085 carries a CVSS 9.6 Critical score, while CVE-2026-85094 is rated 8.8 High. Both affect versions before 2.376.0.
This is the kind of mobile bug that looks small until you understand where the trust boundary is.
Canva’s Android application embeds web content inside the app using WebView.
That WebView isn’t just a miniature browser window.
In a privileged application context, it can communicate with native application functionality and handle information associated with the user’s authenticated session.
CVE-2026-85085 breaks the origin boundary.
The vulnerable app can load an external origin inside a privileged WebView without properly verifying where that content came from.
If an attacker controls the page loaded into that WebView, the page can communicate with Canva using the victim’s existing session.
That’s the important part.
The attacker doesn’t necessarily need the user’s Canva password.
The victim already has one.
It’s sitting inside the application’s authenticated context.
CVE-2026-85094 makes the situation worse from a session-security perspective.
The application did not properly restrict which HTTP headers were returned to an external origin running inside the privileged WebView.
A threat actor controlling that WebView could access information associated with the user’s session.
Two different bugs.
One ugly trust boundary.
- The Damage: A victim who interacts with attacker-controlled content can potentially have their authenticated Canva session abused, allowing access to account data and actions available through that session.
The attack still needs user interaction.
That’s reflected directly in the CVSS vectors.
For CVE-2026-85085:
AV:N / AC:L / PR:N / UI:R / S:C / C:H / I:H / A:L
The vulnerability is network-reachable and requires no attacker privileges, but the victim has to interact with the malicious content. Its CVSS 3.1 score is 9.6 Critical.
CVE-2026-85094 carries 8.8 High under CVSS 3.1, again requiring user interaction while giving the attacker a path to sensitive session information.
That’s enough to make phishing-style delivery interesting.
An attacker doesn’t need to convince someone to hand over a password.
They can instead try to get the victim to load a page through the vulnerable application flow and let the application’s own session context do the heavy lifting.
This is why WebView security is so different from ordinary browser security.
A browser normally enforces strong origin isolation.
A mobile application can deliberately give its WebView additional privileges because the application needs to communicate with web content.
If the application fails to distinguish trusted content from attacker-controlled content, those privileges become the attack surface.
And Canva wasn’t dealing with one isolated issue.
The two CVEs were published within minutes of each other on September 4.
CVE-2026-85085 was assigned CWE-940, covering improper verification of the source of a communication channel.
CVE-2026-85094 was assigned CWE-212, covering improper removal of sensitive information before transfer.
The result is a nasty combination:
Untrusted web content + privileged WebView + authenticated session.
That is exactly where mobile application security starts getting interesting.
- The Fix: Update the Canva Android application to 2.376.0 or later and treat older installations as vulnerable.
The affected range is everything before version 2.376.0.
For organizations managing Android devices, don’t rely on users to remember whether Canva updated itself.
Check the installed application version through your mobile-management tooling.
If vulnerable versions remain deployed, push the update.
And if you are investigating a potentially targeted attack, look beyond the Canva application itself.
Review suspicious links.
Review browser and WebView activity where available.
Look for unexpected account activity after users interacted with untrusted content.
Most importantly, invalidate active sessions if you believe a vulnerable device was targeted.
A password reset alone may not immediately invalidate every existing authenticated session.
The CVE records currently show no CISA KEV listing and no confirmed widespread exploitation.
That is good.
But CVE-2026-85085 already has a 9.6 Critical rating, and the attack requires only a victim to interact with attacker-controlled content.
That’s not a vulnerability worth leaving installed while waiting for someone to publish an exploit.
Bugstoday’s Opinion
This is why “the password wasn’t stolen” isn’t always a useful security metric.
The attacker doesn’t necessarily need the password.
They need the application to lend them the session.
WebView vulnerabilities are particularly nasty because the victim’s device is doing exactly what the application was designed to do.
Load content.
Keep the user logged in.
Talk to the native application.
The security failure happens when the app forgets to ask the most important question:
Who owns this content?
If the answer is “some random website the attacker controls,” the WebView should never have been given the keys to the kingdom.
Update Canva.
Then stop treating embedded browsers as harmless UI components.
They’re part of your attack surface.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
CVE-2026-85085
CVE-2026-85094
Canva Security Advisory
CVE.org / MITRE
NVD
Positive Technologies PT-2026-85425
Positive Technologies PT-2026-85426
