Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-04 | 2 | Disclosure1General1 |
| 2026-09-09 | 1 | Patch1 |
🚨 HIGH: CVE-2026-85094 (CVSS 8.8) Canva Android App <2.376.0 vulnerable to session hijacking via unrestricted WebView headers. Attackers could access user sessions. ✅ Update to v2.376.0+ #CVE #Vulnerability #PatchNow https://t.co/pLY8y7y6bK
Post summary
The tweet alerts audiences to CVE‑2026‑85094, a session hijacking flaw in Canva Android apps before v2.376.0, and urges users to patch to the newer version.
⚠️ Vulnerabilidades en Aplicación para Android ❗ CVE-2026-85094 ❗ CVE-2026-85085 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-aplicacion-para-android/ https://t.co/Sx168YCu2P
Post summary
The tweet announces two CVEs affecting an Android application and directs readers to external links for additional information.
CVE-2026-85094 The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the … https://www.cve.org/CVERecord?id=CVE-2026-85094
Post summary
The CVE-2026-85094 disclosure indicates a header leakage issue in the Canva Android application that could allow threat actors with control over an external origin to access restricted headers via a privileged WebView.