CVE-2026-92839 Overview
CVE-2026-92839 affects Canva Desktop versions before v1.125.0. The application performs double decoding in its deeplink handler, allowing a threat actor to coerce the client into loading arbitrary same-origin content under the victim's authenticated session. The flaw is categorized under [CWE-174] Double Decoding of the Same Data. Exploitation requires user interaction, such as clicking a crafted deeplink URL. The vulnerability does not directly compromise confidentiality or availability, but it enables limited integrity impact by rendering attacker-controlled content within the trusted Canva origin context.
Critical Impact
An attacker who convinces a user to open a malicious canva:// deeplink can load arbitrary same-origin content inside the desktop client, executing actions under the authenticated user's session.
Affected Products
- Canva Desktop versions prior to v1.125.0
Discovery Timeline
- 2026-09-17 - CVE-2026-92839 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-92839
Vulnerability Analysis
Canva Desktop registers a custom deeplink URI scheme that routes inbound URLs into an in-application handler. The handler decodes the incoming URL parameters and then decodes them a second time before using the resulting string to construct a same-origin navigation target. This double decoding allows an attacker to smuggle encoded control characters and path segments through validation checks that only inspect the singly-decoded form.
Because the resulting navigation is treated as first-party content within the Canva origin, any loaded resource inherits the authenticated user's session, cookies, and privileges. The end result is that a threat actor can direct the desktop client to render arbitrary same-origin content chosen by the attacker.
Root Cause
The root cause is improper input canonicalization in the deeplink handler. Validation logic evaluates the URL after a single decoding pass, but a second decoding step occurs later in the pipeline before the URL is used. Encoded sequences such as %2525 survive the first decode as %25, then decode to % on the second pass, allowing reserved characters and path traversal sequences to bypass allowlist checks. This pattern maps directly to [CWE-174].
Attack Vector
An attacker crafts a malicious deeplink URL, for example canva://open?url=https%253A%252F%252Fcanva.com%252Fattacker-controlled-path, and delivers it through email, chat, or a web page. When the victim activates the link, the Canva Desktop client processes the deeplink, performs two decoding passes, and loads the attacker-chosen resource under the authenticated canva.com origin. The attacker can then trigger in-application actions, exfiltrate session-scoped data, or stage further social engineering inside the trusted application shell. Refer to the Canva Trust Center for vendor communications regarding this issue.
Detection Methods for CVE-2026-92839
Indicators of Compromise
- Deeplink invocations containing double-encoded sequences such as %2525, %252F, or %253A in the canva:// URI parameters.
- Canva Desktop process loading unexpected same-origin paths shortly after a URI scheme handler invocation.
- Browser or mail client logs showing user clicks on canva:// URLs originating from untrusted senders.
Detection Strategies
- Inspect endpoint telemetry for launches of the Canva Desktop client with command-line arguments containing encoded deeplink payloads.
- Correlate URI scheme handler activations with subsequent outbound network requests to non-standard paths within the Canva origin.
- Hunt for the version string of Canva Desktop across managed endpoints to identify installations older than v1.125.0.
Monitoring Recommendations
- Log all custom URI scheme invocations at the operating system level and forward them to a centralized analytics pipeline.
- Monitor email and messaging gateways for links using the canva:// scheme, especially those containing multiple layers of percent-encoding.
- Track Canva Desktop application version inventory to confirm patch adoption across the fleet.
How to Mitigate CVE-2026-92839
Immediate Actions Required
- Upgrade Canva Desktop to version v1.125.0 or later on all managed endpoints.
- Communicate to users that they should not click canva:// deeplinks received from untrusted sources.
- Audit endpoint inventory to identify systems still running vulnerable Canva Desktop builds.
Patch Information
Canva addressed the double decoding flaw in Canva Desktop v1.125.0. The fix eliminates the second decoding pass in the deeplink handler and enforces validation on the canonicalized URL before navigation. Refer to the Canva Trust Center for vendor guidance and update instructions.
Workarounds
- Where feasible, unregister or block the canva:// custom URI scheme on endpoints that cannot immediately update.
- Use endpoint management tooling to enforce a minimum installed version of Canva Desktop and quarantine non-compliant hosts.
- Apply email and web gateway rules that strip or warn on links using the canva:// scheme originating from external senders.
# Example: check installed Canva Desktop version on macOS
defaults read /Applications/Canva.app/Contents/Info.plist CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.