Description

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T07:17:11.263Z",
  "pubdate": "2026-09-04T07:17:11.263Z",
  "executiveSummary": "The Canva Android application, specifically versions prior to 2.376.0, contained a critical vulnerability involving insecure WebView implementation.\nThe flaw stems from a failure to properly restrict headers returned to external origins within a privileged WebView environment.\nThis vulnerability allows a remote threat actor who has gained control of the WebView environment to perform unauthorized operations or intercept sensitive information.\nSuccessful exploitation results in the compromise of a user’s authenticated session, potentially leading to unauthorized account access or data exposure.\nThe vulnerability represents a significant risk to user privacy and session integrity, as it bypasses standard origin-based security boundaries.\nThis flaw necessitates that developers implement strict controls over how privileged WebViews handle headers and origin interactions to prevent unauthorized cross-origin data access.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper configuration of the WebView component within the Canva Android application (versions prior to 2.376.0).\nIn Android development, WebViews with elevated permissions or those capable of accessing sensitive app-level data must strictly enforce security policies regarding cross-origin requests and header management.\nThe application failed to implement adequate security checks on headers returned from external origins loaded within the WebView.\nWhen a WebView is configured as 'privileged,' it may possess the capability to access local app resources, session cookies, or authorization tokens if not properly isolated from untrusted web content.\nThe attack flow begins when an attacker directs the vulnerable WebView to navigate to a malicious or compromised web origin under their control.\nBecause the application did not restrict the headers being returned to this external origin, the malicious site was able to interact with the WebView's context in a way that permitted the extraction of sensitive session identifiers.\nEssentially, the WebView failed to enforce a 'same-origin' policy or implement sufficient header filtering that would have prevented the leakage of authentication credentials to an untrusted external entity.\nAn attacker with control over the content served to the WebView can leverage this lack of restriction to inject scripts or manipulate the header responses, effectively exfiltrating the session token back to their own server.\nOnce the session identifier is successfully exfiltrated, the attacker can hijack the user's session, bypassing standard authentication mechanisms and gaining full access to the user's Canva account resources.\nThis exploitation does not require advanced network-level access, but rather relies on the attacker's ability to trigger the WebView to load an arbitrary or malicious external URL.\nThe post-exploitation impact is severe, as the attacker effectively assumes the identity of the authenticated user within the scope of the Canva application until the session is invalidated by the server."
}