CVE-2026-90860

Published: Set 21, 2026 Last Modified: Set 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Source: 61adb53e-e4b3-47f7-8a93-4717c9e77dc6
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: none

Description

AI Translation Available

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

212

Improper Removal of Sensitive Information Before Storage or Transfer

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Files Or Directories Read Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://trust.canva.com?tcuUid=c17214e0-e758-4472-8238-abeb…
https://trust.canva.com?tcuUid=c17214e0-e758-4472-8238-abeb79faff07