CVE-2026-90860 in Canva
Summary
by MITRE • 09/21/2026
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in versions of the Canva mobile application prior to version 1.15.1 for HarmonyOS stems from an improper restriction on HTTP response headers when interacting with external origins within a privileged Web View context. In modern mobile application architecture, particularly those utilizing hybrid approaches that embed web content via components like WebView or WKWebView, there is often a need to facilitate communication between the native application layer and the embedded web view. This interaction typically involves passing sensitive data such as authentication tokens, session identifiers, or configuration parameters from the native code into the JavaScript environment of the loaded webpage. The core technical flaw lies in the failure to implement strict controls over which headers are exposed during cross-origin requests initiated by external domains running within this privileged container. By not filtering or sanitizing these response headers, the application inadvertently leaks sensitive information that was intended solely for internal use or restricted contexts.
This misconfiguration creates a significant security gap because it allows any script executed within an external origin loaded in the Web View to access HTTP response headers that contain critical session data. A threat actor who has gained control over the execution environment of this WebView, either through cross-site scripting vulnerabilities present in the hosted content or by manipulating malicious third-party scripts embedded in the page, can exploit this exposure. Once such a script is executed, it can read the exposed headers and extract user-specific authentication tokens or session cookies. This effectively bypasses standard security boundaries that rely on same-origin policies to isolate sensitive data from untrusted web contexts. The ability to access these credentials allows an attacker to hijack the active user session without requiring additional exploitation steps such as password cracking or multi-factor authentication bypass, provided the session remains valid.
The operational impact of this vulnerability is severe, primarily centering on account takeover and unauthorized access to sensitive user data. Since Canva handles creative assets, personal documents, and potentially corporate intellectual property depending on the subscription tier, compromising a user’s session grants an attacker full control over their workspace. This can lead to the theft of proprietary designs, modification or deletion of critical files, and further exploitation within any integrated services linked to that account. Furthermore, if users reuse credentials across other platforms, the stolen tokens could facilitate broader identity compromise beyond just the Canva ecosystem. The risk is amplified in enterprise environments where team collaboration features are heavily utilized, as compromising one user’s session might provide a foothold for lateral movement or social engineering attacks against colleagues within shared projects.
From a classification perspective, this issue aligns with CWE-201: Exposure of Sensitive Information Through Response Headers and CWE-798: Use of Hard-coded Credentials if the headers contained static secrets, though it is primarily an information disclosure flaw related to improper access control in web views. In terms of the MITRE ATT&CK framework for mobile platforms, this vulnerability facilitates techniques associated with Credential Access via Browser Session Hijacking or Collection from Web Browsers. The attacker leverages the trusted relationship between the native app and its embedded WebView to extract credentials that would otherwise be protected by browser security models. To mitigate this risk, developers must implement strict header filtering mechanisms within the network layer of the application before passing data into the JavaScript context. This involves whitelisting only necessary headers for external origins while stripping or masking sensitive fields such as Set-Cookie, Authorization, and custom session identifiers. Additionally, employing Content Security Policy directives to restrict script execution sources and ensuring that privileged APIs are not exposed unnecessarily to untrusted web content can significantly reduce the attack surface. Regular security audits of hybrid app implementations should specifically target cross-origin data flow patterns to prevent similar exposures in future updates.