CVE-2026-85085
Critical · 9.6CVSS
9.6
EPSS
0.4%
Published
Sep 4, 2026
CISA due date
—
The record
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin… CWE-940
- CVE-2026-73419 NextAuth.js provides authentication for Next.js. CWE-940
- GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable… CWE-940
- CVE-2026-54106 The U.S. CWE-940
- CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across… CWE-940
- CVE-2026-44894 Netty is a network application framework for development of protocol servers and clients. CWE-940
- GHSA-x426-x7cc-3fpc @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme… CWE-940
- CVE-2026-44698 Home Assistant is open source home automation software that puts local control and… CWE-940