Exposure of Canva

Page builders

13

exposure score

293

sites use

0

exploited

1

critical

CVEs

4 results

CVE-2026-85094HIGHThe Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat EPSS 0.2%CVE-2026-85085CRITICALThe Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page lEPSS 0.2%CVE-2026-92839MEDIUMCanva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrarEPSS 0.2%CVE-2025-12792LOWThe Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor withEPSS 0.1%