[CVE-2026-85094] The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin ru…

Descripción técnica

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

Puntuación CVSS

Score: 8.8/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Debilidades (CWE)

CWE-212

Fuente oficial

Publicado en NIST NVD.