CVE-2026-90860 Overview
CVE-2026-90860 affects the Canva Mobile App for HarmonyOS before version v1.15.1. The application did not restrict HTTP headers returned to external origins loaded inside a privileged WebView. An attacker who controls content rendered in that WebView can read headers containing session material and gain access to the user's authenticated session. The flaw is categorized under [CWE-212]: Improper Removal of Sensitive Information Before Storage or Transfer. Exploitation requires user interaction, such as loading an attacker-influenced URL within the vulnerable WebView context.
Critical Impact
A threat actor controlling the WebView content can capture session headers and hijack an authenticated Canva user session on HarmonyOS devices.
Affected Products
- Canva Mobile App for HarmonyOS versions prior to v1.15.1
Discovery Timeline
- 2026-09-21 - CVE-2026-90860 published to the National Vulnerability Database (NVD)
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-90860
Vulnerability Analysis
The Canva Mobile App for HarmonyOS embeds a privileged WebView component used to render web content within the app's trust boundary. The application failed to enforce origin-based restrictions on HTTP response headers exposed to code executing inside that WebView. When an external origin loads in the privileged context, JavaScript running in that origin can inspect headers that should remain internal to the app-to-service communication channel.
Those headers include authentication material tied to the user's active session. An attacker who influences the WebView's navigation can read the exposed headers and reuse them to authenticate to Canva services as the victim. The confidentiality impact is limited to header contents, but the integrity impact is high because captured credentials enable full session takeover.
Root Cause
The root cause is missing header sanitization on cross-origin responses inside a privileged WebView, consistent with [CWE-212]. The app treated all responses within the WebView as equally trusted rather than segmenting headers by origin. Sensitive session identifiers were therefore returned to external origins that had no legitimate need to receive them.
Attack Vector
Exploitation follows a network-based path with user interaction. An attacker directs the victim to navigate the vulnerable WebView to an attacker-controlled or attacker-influenced origin, for example through a crafted link, deep link, or compromised third-party content. Script within that origin reads the exposed response headers using standard WebView APIs and exfiltrates the session material to an external endpoint. The attacker then replays those headers against Canva backend services to act as the user.
No verified public exploit code is available for CVE-2026-90860. See the Canva Trust Resource for vendor detail.
Detection Methods for CVE-2026-90860
Indicators of Compromise
- Outbound requests from HarmonyOS devices running the Canva app to domains that are not part of Canva's published service infrastructure.
- Canva account activity originating from IP addresses or user agents that do not match the legitimate user's device fingerprint.
- WebView navigation events to unexpected external origins immediately preceding anomalous session use.
Detection Strategies
- Inspect mobile telemetry for Canva app versions below v1.15.1 on HarmonyOS endpoints and flag them for upgrade.
- Correlate Canva session identifiers observed from multiple distinct network egress points within short time windows as candidate session hijacks.
- Monitor identity provider logs tied to Canva single sign-on for concurrent sessions from geographically inconsistent locations.
Monitoring Recommendations
- Enable audit logging on Canva enterprise tenants and forward events to a centralized SIEM for correlation with mobile device inventory.
- Track WebView-related crash and navigation telemetry from mobile device management (MDM) tooling to detect suspicious redirection patterns.
- Alert on new API tokens or session reuse from user agents that identify as non-HarmonyOS after a HarmonyOS session was established.
How to Mitigate CVE-2026-90860
Immediate Actions Required
- Upgrade the Canva Mobile App on HarmonyOS to version v1.15.1 or later on every affected device.
- Invalidate active Canva sessions for users who ran vulnerable app versions and require re-authentication.
- Rotate any API tokens or connected-app credentials tied to potentially exposed accounts.
Patch Information
Canva addressed the header exposure in Canva Mobile App for HarmonyOS v1.15.1. Refer to the Canva Trust Resource for the vendor advisory and release notes.
Workarounds
- Restrict Canva app usage on HarmonyOS devices through MDM policy until the patched version is deployed.
- Instruct users to avoid opening untrusted links inside the Canva app on HarmonyOS.
- Enforce short session lifetimes and require multi-factor authentication for Canva accounts to reduce the value of captured session headers.
# Example MDM query to identify vulnerable installations
mdmctl query --app com.canva.editor --os harmonyos --version-lt 1.15.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
