Privileged WebView Allows Unauthorized External Origin Loading

CVE-2026-85085 represents a critical authorization bypass vulnerability in the Canva Android application prior to version 2.376.0. The flaw enables external origins to load within a privileged WebView context, creating a bridge between attacker-controlled content and authenticated user sessions. This affects millions of Canva mobile users whose devices remain unpatched, particularly those in creative and design sectors relying on the platform for professional work. An attacker can exploit this by hosting malicious content and tricking users into visiting it, after which the malicious page gains direct access to communicate with Canva's privileged context using the victim's authenticated session—potentially leading to unauthorized access to designs, account data, or credential theft.

While this CVE does not map to specific MITRE ATT&CK techniques in the initial advisory, Casky's security skills powered by Claude AI would detect the underlying attack patterns associated with execution and credential access techniques. Practitioners using Casky would observe findings related to improper input validation, insecure WebView configuration (similar to T1203 - Exploitation for Client Execution), and session hijacking indicators (correlating with T1187 - Forced Authentication). The platform's 754 mapped skills would flag anomalies in WebView bridge communications, external URL loading patterns in privileged contexts, and unexpected cross-origin data flows. Security teams reviewing Casky's extended reasoning analysis would see detailed breakdowns of how the vulnerability chain works, enabling them to prioritize patching, implement WebView security controls, and monitor for exploitation attempts in user activity logs.