CVE-2026-85085

The Canva Android app prior to version 2.376.0 contains a critical vulnerability that permits external origins to be loaded in a privileged WebView, enabling threat actors to hijack user sessions. This flaw allows attackers to interact with the Canva application on behalf of the user, potentially leading to unauthorized access to sensitive information. Android app developers and organizations utilizing the Canva app should prioritize updating to the latest version to mitigate this risk.