VulnSocial

CVE-2026-85085General

LOWCVSS 9.6 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-940

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • General: 3 classified signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-09-12)
  • 5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-09-04: 1Mentions · 2026-09-09: 1Mentions · 2026-09-11: 1Mentions · 2026-09-12: 2Technical Details · 2026-09-09: 1Technical Details · 2026-09-12: 109-0409-0909-1109-12
Signal classification2 categories
General
360.0%
Disclosure
240.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-041
Disclosure1
2026-09-091
Disclosure1
2026-09-111
General1
2026-09-122
General2
Full discourse5 posts
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【重要】Canva AndroidにCVSS 9.6、2.376.0へ更新を https://www.cybernote.click/2026/09/07/canva-android-cve-2026-85085-85094-webview-session/ #IT #Security #cybersecurity

    Post summary

    The post alerts to a Canva Android update tied to CVSS 9.6 and CVEs 2026-85085/85094, but lacks any exploit details, active usage claims, patch info or PoC references.

    0001047
    204 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【重要】Canva AndroidにCVSS 9.6、2.376.0へ更新を https://www.cybernote.click/2026/09/07/canva-android-cve-2026-85085-85094-webview-session/ #IT #Security #cybersecurity

    Post summary

    The message merely announces a Canva Android update tied to a CVE with a CVSS score, without offering technical details, PoC, exploit code, or evidence of exploitation.

    0001048
    204 followersView on X
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 CRITICAL: CVE-2026-85085 (CVSS 9.6) Canva Android App <2[.]376[.]0 allows external origins in privileged WebView. Attackers can hijack user sessions via malicious pages. Update immediately. #CVE #Vulnerability #PatchNow https://t.co/at6r3POJMS

    Post summary

    The tweet announces a critical vulnerability (CVE-2026-85085) in older Canva Android apps that allows session hijacking via external origins in privileged WebView, and urges users to update immediately.

    0000158
    129 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    【重要】Canva AndroidにCVSS 9.6、2.376.0へ更新を https://www.cybernote.click/2026/09/07/canva-android-cve-2026-85085-85094-webview-session/ #IT #Security #cybersecurity

    Post summary

    The brief notice reports that Canva Android is updated concerning CVE‑2026‑85085‑85094 with a CVSS score of 9.6, but offers no technical, exploit, or remediation details.

    0000054
    204 followersView on X
  • CERT-PY@CERTpy
    Disclosure

    ⚠️ Vulnerabilidades en Aplicación para Android ❗ CVE-2026-85094 ❗ CVE-2026-85085 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-aplicacion-para-android/ https://t.co/Sx168YCu2P

    Post summary

    The text announces two Android application CVEs and directs readers to an external link for more information, but provides no further technical or operational details.

    00000266
    6.7K followersView on X

Explore more

Back to dashboard