CVE-2026-90860 Canva CVE debrief

Who should care

Defenders responsible for the Canva Mobile App for HarmonyOS, HarmonyOS users, and security teams should be aware of this vulnerability and take necessary actions to protect user sessions.

Why it matters

Defenders should care about CVE-2026-90860 because it allows session hijacking for users of the Canva Mobile App for HarmonyOS, compromising user session security if the WebView is controlled by a threat actor. Verification of the Canva Mobile App for HarmonyOS version is necessary to determine exposure, and remediation priority is high for HarmonyOS users of the Canva Mobile App.

• Session hijacking is possible for users of the Canva Mobile App for HarmonyOS.
• User session security is compromised if the WebView is controlled by a threat actor.
• Verification of the Canva Mobile App for HarmonyOS version is necessary to determine exposure.
• Remediation priority is high for HarmonyOS users of the Canva Mobile App.

Technical summary

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView, allowing a threat actor with control of the WebView to access a user’s session. This vulnerability enables threat actors to hijack user sessions, emphasizing the need for defenders to verify the version of the Canva Mobile App for HarmonyOS and ensure it is updated to v1.15.1 or later to prevent session hijacking.

Defensive priority

Defenders should prioritize verifying the version of the Canva Mobile App for HarmonyOS and ensuring it is updated to v1.15.1 or later.

Recommended defensive actions

• Verify the version of the Canva Mobile App for HarmonyOS and ensure it is updated to v1.15.1 or later.
• Monitor for any suspicious activity related to the Canva Mobile App for HarmonyOS.
• Consider implementing additional security measures to protect user sessions.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, but further verification is needed to determine the extent of the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.