Description

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-04T07:17:11.133Z",
  "pubdate": "2026-09-04T07:17:11.133Z",
  "executiveSummary": "The Canva Android application, prior to version 2.376.0, contains a critical vulnerability stemming from improper WebView configuration. This flaw allows an external, attacker-controlled origin to be loaded within a privileged WebView context.\nThe vulnerability type is categorized as an insecure WebView configuration, which facilitates unauthorized cross-origin communication. The impact is significant, as it enables a threat actor to execute actions or extract information on behalf of the authenticated user by leveraging the victim's existing session.\nThis vulnerability poses high risk implications for user account security, potentially leading to unauthorized data access, account manipulation, or unauthorized content modification. Successful exploitation requires the victim to be lured into loading a malicious web page within the compromised application environment. Once the malicious content is rendered in the privileged WebView, the attacker gains the capability to interface with the application’s internal bridge, effectively bypassing the same-origin policy protections that would normally restrict such interactions.\nThe attack vector is network-based, requiring the attacker to control the content of the page loaded by the user within the vulnerable application context.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the Android WebView component within the Canva Android application before version 2.376.0. Specifically, the application failed to properly validate or restrict the origin of content loaded within its privileged WebView instances.\nWhen an application utilizes a WebView, it often exposes JavaScript interfaces—via 'addJavascriptInterface'—to allow web content to interact with native Android code. If these interfaces are exposed to untrusted origins, an attacker can invoke privileged methods provided by the application. In the context of the Canva Android app, the WebView was configured in a manner that permitted the loading of arbitrary external URLs while maintaining access to these sensitive native bridge interfaces.\nThe exploitation flow proceeds as follows: First, a threat actor identifies a mechanism to force the Canva application to navigate to an attacker-controlled web domain. This could be achieved through social engineering, link injection, or manipulation of intents that trigger the WebView. Once the application loads the malicious page, the WebView renders the external content.\nBecause the WebView was not properly sandboxed or configured to strictly enforce origin checks, the malicious script running on the attacker's page gains the ability to communicate with the native application layer via the exposed interfaces. The attacker can then issue unauthorized commands or function calls to the native backend using the user's active session credentials and privileges. This effectively bypasses the application's intended security boundary, as the WebView acts as a bridge for the attacker to perform actions as the authenticated user.\nThis vulnerability is particularly severe because the application context trusts the content loaded in the WebView as if it were a legitimate part of the Canva environment. The impact of post-exploitation activity is limited only by the permissions and functionality exposed through the native-to-web bridge. This can include, but is not limited to, the exfiltration of session tokens, the performance of unauthorized API requests to the Canva backend, and the manipulation of user account settings or project data."
}